Description
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
aleksey-hoffman Sigma File Manager
Default version status: unaffected
0 to ≤ 2.2.0affected
References
- https://github.com/aleksey-hoffman/sigma-file-manager/issues/552 ↗
- https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479 ↗
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs ↗
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs ↗
- https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands ↗