CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to bypass the server-side request forgery guard in Shepherd's citation-checker by exploiting a flaw in how the public_url guard validates addresses. This can lead to unauthorized access to internal HTTP(S) services if an attacker controls the DNS of a crafted reference URL, potentially exposing sensitive data. Organizations using Shepherd versions prior to 0.3.1 should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.