Description
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jina-ai reader
Default version status: unaffected
45d1682db02f0c50b680ad350855da4e38ab2122 to ≤ 1574bfd380d249c86c82db4dace0d9c8fe17e2b1affected
pkg:github/jina-ai/readerReferences
- https://github.com/jina-ai/reader/issues/1253 ↗
- https://github.com/jina-ai/reader ↗
- https://github.com/jina-ai/reader/blob/1574bfd380d249c86c82db4dace0d9c8fe17e2b1/src/services/misc.ts ↗
- https://www.vulncheck.com/advisories/jina-ai-reader-server-side-request-forgery-via-disabled-private-address-guard ↗