Threats affecting pkg:github/getfider/fider

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.

Fider versions before 0.38.0 have a server-side request forgery (SSRF) vulnerability caused by a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. This flaw allows administrators with DNS control to perform DNS rebinding attacks, potentially causing the Fider server to send requests to internal services or cloud metadata endpoints. The vulnerability has a low severity score and no known exploits in the wild.