Description

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T19:16:31.873Z",
  "pubdate": "2026-08-17T19:16:31.873Z",
  "executiveSummary": "A blind Server-Side Request Forgery (SSRF) vulnerability exists in DataHub v.1.5.0.1, enabling a remote attacker to execute arbitrary code.\nThe vulnerability resides in the server-side functionality responsible for retrieving and processing external images via crafted URLs.\nBecause the vulnerability is of a blind SSRF nature, the affected application fails to return the retrieved content or any explicit execution errors directly to the attacker.\nThe primary impact of successful exploitation includes remote code execution within the context of the vulnerable server infrastructure.\nThis flaw poses severe risk implications, potentially leading to full system compromise, internal network enumeration, and unauthorized access to backend services.\nAttackers require network access to the target application and the ability to supply a malicious, specially crafted URL that the server will process.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization of user-supplied URLs within the image retrieval component of DataHub v.1.5.0.1.\nWhen the application attempts to fetch an image from a URL provided by a remote user, it fails to restrict the destination addresses to trusted domains or internal network boundaries.\nThe attack flow begins when a remote, unauthenticated attacker submits a crafted URL designed to target internal services or trigger unsafe deserialization and code execution pathways during the retrieval or rendering process.\nDue to the blind nature of the SSRF, the application initiates the outbound HTTP request on behalf of the attacker but does not reflect the response body or error messages in the HTTP response returned to the client.\nDespite the lack of direct output, the underlying network interaction or processing logic allows the attacker to achieve arbitrary code execution on the host system.\nThe affected component is the server-side image fetching mechanism present in DataHub version v.1.5.0.1.\nExploitation requires network exposure of the vulnerable application, allowing the attacker to reach the HTTP endpoints responsible for processing external URLs.\nNo specific user authentication or elevated privileges are explicitly required if the targeted image retrieval functionality is exposed externally."
}