Threats tagged 'ghsa-p838-xx56-rf99'

Oqtane Framework versions prior to 10.3.0 contain a server-side request forgery (SSRF) vulnerability in the UploadFile endpoint of FileController.cs. Authenticated users can exploit this flaw by supplying a crafted URL parameter, causing the server to fetch arbitrary URLs without validating the scheme, host, or IP address. This allows attackers to access internal resources such as cloud metadata services or localhost management interfaces, save the responses as files in their user folder, and retrieve them to exfiltrate sensitive data or perform internal network reconnaissance.