CyberRota Analysis
AI-GeneratedFlaskBB versions prior to 2.2.1 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the get_image_info() function, which allows authenticated users to send HTTP requests to arbitrary internal endpoints, potentially exposing sensitive internal services and cloud metadata. This vulnerability could lead to unauthorized access and exploitation of internal APIs, making it critical for organizations using FlaskBB to prioritize upgrading to version 2.2.1 to mitigate risks. Users of this forum software should take immediate action to protect their systems from potential internal threats.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.