OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to enumerate and interact with internal services.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/volcengine/OpenViking/commit/41e345896d247e43ab78bbcb38b4a5b…
disclosure@vulncheck.com
https://github.com/volcengine/OpenViking/pull/1133
disclosure@vulncheck.com
https://github.com/volcengine/OpenViking/releases/tag/v0.3.4
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/openviking-ssrf-via-api-v1-resources
disclosure@vulncheck.com
https://github.com/volcengine/OpenViking/pull/1133https://github.com/volcengine…
134c704f-9b21-4f2e-91b3-4a467353bcc0