CyberRota Analysis
AI-GeneratedThe Plane project management tool prior to version 1.4.0 is vulnerable due to improper handling of OAuth avatar synchronization, allowing attackers to exploit the avatar URL to redirect to internal resources. This flaw can lead to unauthorized access and exfiltration of sensitive internal data, as the fetched content is exposed through the API. Organizations using affected versions should prioritize upgrading to 1.4.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.