Description
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Tencent WeKnora
Default version status: unaffected
0.5.2 to < 0.7.0affected
pkg:golang/github.com/Tencent/WeKnoraReferences
- https://github.com/Tencent/WeKnora/issues/2511 ↗
- https://github.com/Tencent/WeKnora ↗
- https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328 ↗
- https://github.com/Tencent/WeKnora/blob/v0.6.2/internal/application/service/knowledge_util.go#L339-L348 ↗
- https://www.vulncheck.com/advisories/weknora-before-0.7.0-ssrf-via-unvalidated-http-redirects ↗