🔴 《严重安全漏洞：CVE-2026-63306》

CVSS 评分: 严重（9.2）　　状态: Deferred　　发布时间: 2026-07-16

漏洞描述

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

🔍 技术细节

字段 值
CVE ID CVE-2026-63306
CVSS 评分 9.2 🔴
严重程度 严重
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-918
发布时间 2026-07-16
最后更新 2026-07-16
状态 Deferred
数据来源 disclosure@vulncheck.com

🔗 参考链接