Description
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can connect to the /ws/import_files WebSocket endpoint without authentication, specify arbitrary URLs in the HTMLReader configuration, and cause the server to fetch internal resources such as co-located database endpoints or cloud instance metadata services to retrieve sensitive credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Weaviate Verba
Default version status: affected
0 to ≤ 2.1.3affected
References
- https://github.com/geo-chen/oss/blob/main/verba.md#finding-1-unauthenticated-ssrf-in-verba-websocket-import-endpoint-htmlreader ↗
- https://github.com/weaviate/Verba ↗
- https://www.vulncheck.com/advisories/verba-goldenverba-unauthenticated-server-side-request-forgery-via-websocket-import-endpoint-htmlreader ↗