Threats tagged 'ghsa-v55w-mmhm-9mvr'

Rustrak versions before 0.26.0 have a server-side request forgery (SSRF) vulnerability. This flaw allows users with integrations update permission to send crafted requests to arbitrary destinations by using the routing_override.url parameter in the POST /api/integrations/{id}/test endpoint. Exploitation can target internal network addresses including loopback, private network, and cloud metadata services, with the ability to follow redirects and include custom headers. The API response reveals non-2xx response bodies, potentially exposing sensitive information.