PT-2021-17398 · Friendica · Friendica

Parad0X-0Xff · Published 2021-02-18 · Updated 2021-02-26 · CVE-2021-27329

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Friendica version 2021.01

Description The issue allows for Server-Side Request Forgery (SSRF) via the parse url parameter with binurl for DNS lookups or HTTP requests to arbitrary domain names. This could potentially be exploited to access internal resources or make unauthorized requests.

Recommendations For Friendica version 2021.01, consider restricting access to the parse url function with the binurl parameter to minimize the risk of SSRF exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-27329

Affected Products

Friendica

References · 4

• 🔥 https://github.com/friendica/friendica/issues/9929 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27329 · Security Note
• https://t.me/cibsecurity/23821 · Telegram Post