Description

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-02T12:17:15.170Z",
  "pubdate": "2026-09-02T12:17:15.170Z",
  "executiveSummary": "Broken Link Checker versions 2.4.14 and below are susceptible to a Server-Side Request Forgery (SSRF) vulnerability originating from improper input validation within the editor's link management functionality.\nThis vulnerability allows an unauthenticated or low-privileged attacker to induce the web server to perform arbitrary HTTP requests to internal or external resources.\nThe primary risk implications involve the potential for unauthorized access to internal services, cloud metadata services (e.g., AWS IMDS), or the bypassing of network access controls that rely on IP-based perimeter security.\nBy manipulating the request parameters used by the plugin to verify link integrity, an attacker can coerce the server to act as a proxy, potentially leading to information disclosure, port scanning of internal infrastructure, or exploitation of internal-only web applications that lack authentication.\nThe vulnerability is critical as it facilitates network reconnaissance and potential lateral movement within a protected environment, leveraging the trusted status of the host server.",
  "technicalDetails": "The root cause of the SSRF vulnerability lies in the insufficient validation and sanitization of user-supplied URLs handled by the Broken Link Checker plugin during its link validation routines.\nWhen the plugin processes a URL to check its status, it fails to implement an allow-list or perform robust URL parsing to restrict requests to intended destinations, allowing for the injection of arbitrary targets.\nThe exploitation flow typically begins with an attacker identifying a feature within the editor or link management interface that triggers the plugin's validation mechanism. By intercepting or crafting a request containing a modified target URL, the attacker instructs the backend to perform an HTTP request to an arbitrary URI.\nThe vulnerability allows the attacker to specify internal network addresses (e.g., 127.0.0.1, 169.254.169.254) or arbitrary external URLs. Because the requests are initiated by the server itself, the underlying operating system and the web server environment treat these requests as 'trusted' internal traffic.\nTechnical exploitation involves manipulating the request parameters so that the server-side code performs GET or POST requests to resources reachable from the server's network interface. If the server is hosted in a cloud environment, an attacker can leverage this SSRF to retrieve sensitive credentials or configuration data from instance metadata services.\nThe vulnerable component is the link checking engine responsible for querying remote resources. This component lacks the necessary logic to block requests to non-routable, private, or loopback IP ranges. The absence of strict URL parsing means that various schemes or URL obfuscation techniques might be used to bypass simple blacklists if they were present.\nPost-exploitation, an attacker can perform reconnaissance on the internal network topology, identify internal services, or trigger functions in internal APIs that do not require authentication because they implicitly trust the originating server. The impact is escalated if the web server has broader network permissions, allowing for full internal network traversal."
}