mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-30 18:56:19 +00:00
19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
|
### [CVE-2025-1211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1211)
|
||
|
|
|
||
|
|
|
||
|
|
&color=brightgreen)
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/.
This vulnerability can be exploited when users rely on the URL function for host checking.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1
|
||
|
|
- https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||
|
|
|