imgproxy is vulnerable to SSRF against 0.0.0.0
70Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.3epss 0.9%
from disclosure to weapon193 days
Published on NVDJan 27
1st PoC+193d
VulnCheck+304d
exploitation probability
0.9%top 44% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
imgproxy · imgproxypublic PoCs found — 1
vulncheckvulncheck.com/xdb/920e26282c22unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.