CVE-2023-27159: Server-Side Request Forgery (SSRF)

March 31, 2023 (updated April 8, 2023)

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

References

appwrite.com/
gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb
github.com/appwrite/appwrite
notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
nvd.nist.gov/vuln/detail/CVE-2023-27159

Code Behaviors & Features

Detect and mitigate CVE-2023-27159 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →