Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
Vulnerability Description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
curl_cffi 代码问题漏洞
Vulnerability Description
curl_cffi是lexiforest个人开发者的一个支持浏览器指纹模拟的Python HTTP客户端库。 curl_cffi 0.15.0之前版本存在代码问题漏洞，该漏洞源于未限制对内部IP范围的请求且自动跟随重定向，可能导致请求被重定向至内部服务。
CVSS Information
N/A
Vulnerability Type
N/A