Description

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-05T19:17:19.153Z",
  "pubdate": "2026-11-05T19:17:19.153Z",
  "executiveSummary": "Buku (bukuserver) versions through 5.1.1 are susceptible to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw enables remote attackers to manipulate the application into performing unauthorized HTTP requests against internal network resources, including loopback addresses, private subnets, and cloud instance metadata services.\nThe vulnerability arises from insufficient validation of user-supplied URLs processed by the /api/fetch_data and /api/network_handle endpoints. By bypassing the flawed is_bad_url() security filter, an attacker can coerce the server to interact with internal targets, effectively mapping internal network infrastructure or exfiltrating service-specific metadata.\nBecause the vulnerability is unauthenticated and requires no prior access, it poses a significant risk to the confidentiality and integrity of the internal network environment. Successful exploitation allows an attacker to discover internal services, circumvent perimeter security controls, and read sensitive page content such as titles, descriptions, and keywords from internal hosts. This exposure of cloud metadata or local management interfaces can lead to further compromise, including credential theft or unauthorized control of cloud instances. Users are advised to restrict access to the affected APIs and apply input validation hardening to prevent unauthorized outbound request redirection.",
  "technicalDetails": "The vulnerability resides within the request processing logic of the bukuserver component in versions through 5.1.1. Specifically, the API endpoints /api/fetch_data and /api/network_handle accept a user-supplied 'url' parameter which is subsequently utilized to perform outbound HTTP requests. The root cause of this vulnerability is a deficient implementation of the is_bad_url() function, which fails to adequately sanitize or restrict the destination URL against internal network ranges.\nThe attack flow begins when an attacker sends a crafted HTTP request to one of the identified vulnerable endpoints. The application accepts the malicious 'url' parameter and passes it to the underlying request handler without sufficient verification that the destination is a safe, external resource. Because the is_bad_url() validation routine is insufficient, the application is prone to SSRF, allowing the server to initiate connections to arbitrary destinations. Furthermore, the library or module responsible for these requests is configured to follow HTTP redirects, which may be leveraged by attackers to bypass simple blacklists or redirect the server to protected internal IP addresses.\nBy targeting loopback addresses (e.g., 127.0.0.1) or private IP address spaces (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), an attacker can probe internal services that are otherwise inaccessible from the public internet. This includes, but is not limited to, management consoles, internal APIs, and cloud environment metadata services (e.g., 169.254.169.254). Upon successfully connecting to an internal resource, the application processes the response—such as parsing page titles, descriptions, and keywords—and returns this information to the attacker.\nThe impact is significant, as the exploitation is unauthenticated and does not require specific user privileges. The server acts as a proxy, allowing an attacker to map the internal network topology, discover vulnerable services, or potentially exfiltrate sensitive environment metadata that could be used for further escalation. The behavior of following redirects further extends the attack surface, as attackers can utilize open redirectors to circumvent remaining security checks. Remediation necessitates a redesign of the URL validation mechanism to enforce a strictly defined allowlist of permitted hosts and protocols, alongside the disabling of automatic redirection for requests originating from user-controlled parameters."
}