CyberRota Analysis
AI-GeneratedThe Plane project management tool prior to version 1.4.0 is vulnerable due to improper validation of the GITEA_HOST, allowing attackers to exploit the OAuth flow and potentially access internal resources through crafted avatar URLs. This can lead to unauthorized data exposure and security breaches within the network. Organizations using Plane with Gitea OAuth enabled should prioritize upgrading to version 1.4.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.