Threats tagged 'ghsa-2g9c-vf8h-prxx'

Decidim contains a vulnerability in its push-subscription endpoint where an authenticated user can register an attacker-controlled HTTPS URL. When VAPID delivery is enabled, the server sends outbound POST requests to this stored URL, creating a stored, mostly blind server-side request forgery (SSRF) primitive. This allows interaction with arbitrary HTTPS endpoints reachable from the application server, potentially including internal services. The vulnerability affects Decidim versions prior to 0.30.9.