Description
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
knowns-dev knowns
Default version status: unaffected
0 to ≤ 0.33.0affected
pkg:npm/knownsReferences
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-qx9v-m9gg-p5jg ↗
- https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/server/routes/embedding_models.go#L64-L110 ↗
- https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/server/routes/imports.go#L317-L330 ↗
- https://www.vulncheck.com/advisories/knowns-through-0.33.0-server-side-request-forgery-via-embedding-models-endpoint ↗