Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
Vulnerability Description
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
homarr 代码问题漏洞
Vulnerability Description
homarr是Thomas Camlong个人开发者的一个可定制的浏览器主页，用于与主服务器的 Docker 容器进行交互。 Homarr 1.52.0之前版本存在代码问题漏洞，该漏洞源于未经验证的tRPC端点接受任意URL并执行服务器端请求，可能导致服务端请求伪造和端口扫描。
CVSS Information
N/A
Vulnerability Type
N/A