Threats tagged 'ghsa-vw42-752g-5mrp'

YesWiki versions 4.6.2 through 4.6.5 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the ActivityPub feature. The vulnerability arises because the HTTP Signature verification process makes an outbound HTTP GET request to the URL specified in the Signature header's keyId parameter without any validation or cryptographic verification. This allows an attacker to force the server to make arbitrary HTTP requests to internal or external resources, potentially exposing sensitive information such as cloud metadata or internal services. The vulnerable endpoint is publicly accessible and requires only that ActivityPub be enabled on a form.