Description

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-17T18:16:39.660Z",
  "pubdate": "2026-08-17T18:16:39.660Z",
  "executiveSummary": "Kolibri prior to version 0.19.4 is affected by a Server-Side Request Forgery (SSRF) and response reflection vulnerability. The flaw exists within several API endpoints, specifically identified on the RemoteFacilityUser viewsets, which accept an unvalidated baseurl parameter. This allows unauthenticated external attackers to force the Kolibri server to initiate arbitrary HTTP requests to attacker-controlled URLs. Upon fetching the external resource, the server reflects the response body back to the caller in the API output. The primary impact of this vulnerability includes potential information disclosure of internal network resources, service enumeration, and abuse of the Kolibri server as a proxy for malicious requests. Attackers require network access to the Kolibri instance and can exploit the GET endpoint without prior authentication. The risk implications are significant as internal services previously protected from direct external access may be exposed via the server's network stack. Remediation requires upgrading Kolibri to version 0.19.4 or later, which implements proper validation and sanitization of the baseurl parameter across all affected API endpoints to restrict arbitrary URL fetching.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and sanitization of the baseurl parameter passed to specific API endpoints within the Kolibri application. Specifically, the flaw impacts endpoints associated with the RemoteFacilityUser viewsets, where multiple reflection points have been identified during initial reporting and subsequent remediation reviews. The root cause is the application's unconstrained handling of user-supplied uniform resource identifiers to fetch external data programmatically on behalf of the client.\nExploitation occurs when an unauthenticated attacker sends a crafted HTTP GET request to the vulnerable Kolibri API endpoints, supplying a malicious or arbitrary URL within the baseurl parameter. Upon receiving the request, the vulnerable component on the Kolibri server parses the input without validating the scheme, domain, or IP address destination against a safe allowlist. The Kolibri server then executes an outbound HTTP request targeting the attacker-specified URL. After receiving the response from the external or internal target, the Kolibri application captures the response body and reflects it entirely within the HTTP response returned to the calling client.\nThe attack flow proceeds as follows: First, the attacker identifies the exposed, unauthenticated GET endpoint on the RemoteFacilityUser viewsets. Second, the attacker crafts an exploit payload setting the baseurl parameter to point to an internal network resource (such as cloud metadata services or internal microservices) or an external listener controlled by the attacker. Third, the Kolibri server initiates the outbound connection. Fourth, the server processes the fetched data and transmits the raw response back to the attacker, effectively granting the attacker visibility into resources accessible from the server's network interface.\nAffected versions include all releases of Kolibri prior to version 0.19.4. The vulnerability is exposed over the network, allowing remote unauthenticated threat actors to interact with the API endpoints. No privileges are required to exploit the unauthenticated GET endpoint. The behavior of the payload involves forcing the underlying server libraries to perform arbitrary requests, bypassing perimeter network controls that would otherwise block direct access to internal infrastructure."
}