Description

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T01:16:54.277Z",
  "pubdate": "2026-08-20T01:16:54.277Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in AeternaLabsHQ PullMD version 3.2.0. The vulnerability resides within the REST API Endpoint component, specifically involving the /api file and the manipulation of the url argument. This security flaw allows remote attackers to induce the server into making arbitrary outbound HTTP requests to internal or external resources, potentially leading to unauthorized data access, internal network enumeration, or interaction with restricted backend services.\nThe risk implication is critical due to the availability of public exploit disclosures, increasing the probability of active exploitation by malicious actors. The attack vector is fully remote, requiring network access to the API endpoint without explicit mention of prior authentication requirements. The primary remediation path involves upgrading the affected component to version 3.3.0 or applying the official patch identified by hash 96448894cc93ccecb0bdcbf263a9d25390a8455e. Organizations utilizing the vulnerable software should prioritize remediation to eliminate exposure to potential server-side compromise.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient sanitization of user-supplied data within the REST API Endpoint component of AeternaLabsHQ PullMD 3.2.0. Specifically, when processing requests directed to the /api file, the application accepts an untrusted input parameter designated as url. Due to the lack of strict allow-listing or adequate parsing mechanisms, the underlying application logic directly utilizes this parameter to initiate outbound network connections from the host executing the software.\nThe attack flow initiates when a remote, unauthenticated attacker crafts a malicious HTTP request targeting the vulnerable /api endpoint. By supplying a manipulated value in the url argument, the adversary can direct the server to query arbitrary Uniform Resource Identifiers (URIs). This includes internal loopback addresses (e.g., 127.0.0.1 or localhost), local network services (such as metadata endpoints like 169.254.169.254 in cloud environments), or external destinations under the attacker's control.\nUpon receiving the crafted request, the server-side application processes the malicious url payload and executes a backend HTTP request using its own network privileges and contextual trust relationships. The response from the targeted resource may then be processed, reflected, or otherwise interacted with, facilitating further reconnaissance or exploitation.\nThe root cause is classified as an architectural failure in handling external resource references securely, enabling the server to act as a proxy for malicious traffic. Post-exploitation impact encompasses internal network mapping, unauthorized access to microservices hidden behind the perimeter firewall, extraction of sensitive environment variables or cloud instance metadata, and potential Denial of Service (DoS) conditions against internal infrastructure.\nThe vulnerability affects AeternaLabsHQ PullMD version 3.2.0, impacting an unknown function handling the aforementioned parameter. Network exposure is inherent to the REST API Endpoint component, which is accessible remotely over the network."
}