Description

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint. The application fetches the supplied URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-10T11:17:32.253Z",
  "pubdate": "2026-08-10T11:17:32.253Z",
  "executiveSummary": "An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the gabehf/Koito application through version v0.3.2. This security flaw resides within the PATCH /apis/web/v1/album/{id}/image endpoint, where the application processes a user-supplied image_url parameter.\nThe root vulnerability stems from the application fetching the specified URL via server-side HTTP requests without performing input validation, destination host sanitization, or restriction checks against private, loopback, link-local, or otherwise internal network addresses.\nAn attacker possessing authenticated access can leverage this flaw to coerce the vulnerable server into initiating arbitrary outbound HTTP requests targeting internal infrastructure or external entities. This capability bypasses network perimeter defenses, enabling reconnaissance of internal network topologies, interaction with internal microservices, and potential access to sensitive metadata endpoints.\nThe primary risk implication involves unauthorized information disclosure and potential lateral movement within the hosting network architecture. Exploitation of this vulnerability requires valid authentication credentials to interact with the target album endpoint, alongside the ability to supply a malicious URL payload designed to target restricted network destinations.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) affecting gabehf/Koito through version v0.3.2. The vulnerable component is the HTTP request handling logic invoked by the PATCH /apis/web/v1/album/{id}/image endpoint when processing the image_url field.\nThe underlying root cause is the absence of adequate input validation and URL parsing controls prior to executing outbound HTTP requests on behalf of the client. Specifically, the application fails to enforce allowlists or blocklists for destination IP addresses and URI schemes, allowing requests to be directed toward loopback addresses (e.g., 127.0.0.1, [::1]), private network ranges (e.g., 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), link-local addresses (169.254.169.254), and internal services operating behind the network perimeter.\nThe attack flow proceeds as follows: First, an authenticated user or attacker with standard privileges crafts an HTTP PATCH request targeting the /apis/web/v1/album/{id}/image endpoint. Second, the payload incorporates a maliciously crafted image_url value pointing to an internal resource, loopback port, or cloud metadata service rather than a legitimate external image hosting provider. Third, the server receives the request and passes the unvalidated URL to its internal HTTP client implementation. Fourth, the server initiates an outbound TCP connection and HTTP request to the designated target destination, completely bypassing network segmentation boundaries. Finally, depending on the application logic, the server may process the response, leak error messages, or reflect data back to the user, facilitating data exfiltration and internal network mapping.\nThe network exposure includes any deployment of the Koito application where the server has internal network connectivity or access to cloud metadata services. Exploitation requires valid authentication to access the specified API endpoint, but no elevated privileges beyond standard user access are explicitly mentioned as mandatory. Post-exploitation impact encompasses internal port scanning, service enumeration, unauthorized interaction with internal APIs, and potential retrieval of sensitive infrastructure metadata."
}