Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hemmelig has SSRF Filter bypass in Secret Request functionality
Vulnerability Description
Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Hemmelig 安全漏洞
Vulnerability Description
Hemmelig是Hemmelig开源的一个内容加密软件。 Hemmelig 7.3.3之前版本存在安全漏洞，该漏洞源于Webhook URL验证存在SSRF过滤器绕过，可能导致服务器端请求伪造攻击。
CVSS Information
N/A
Vulnerability Type
N/A