Description
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Kareadita Kavita
Default version status: unaffected
0.9.0 to ≤ 0.9.1.4affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kavita-cbl-url-preflight-ssrf ↗
- https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f88dde8eb874cc99a3397eb11/Kavita.Server/Controllers/CBLController.cs#L82-L108 ↗
- https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f88dde8eb874cc99a3397eb11/Kavita.Common/Helpers/FlurlConfiguration.cs#L46-L89 ↗
- https://github.com/Kareadita/Kavita ↗
- https://www.vulncheck.com/advisories/kavita-0.9.0-through-0.9.1.4-ssrf-blocklist-bypass-via-upload-cbl-file-endpoint ↗