wanderer SSRF lets requests reach internal network
Self-hosted trail site can leak data from its internal servers!
Summary
wanderer is a self-hosted trail database for saving and sharing adventures. When PUBLIC_PRIVATE_INSTANCE is not set to true, an unauthenticated attacker can make the server fetch internal services and cloud metadata addresses and return the data.
Affected when
- PUBLIC_PRIVATE_INSTANCE not set to true
What to do
Update to version 0.20.0.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen