CyberRota Analysis
AI-GeneratedKolibri versions prior to 0.19.4 are vulnerable due to several API endpoints that accept an unvalidated `baseurl` parameter, allowing attackers to fetch and reflect content from arbitrary URLs. This could lead to unauthorized data exposure or manipulation, particularly affecting users of the platform who rely on the API for educational resources. Organizations utilizing Kolibri for offline education should prioritize upgrading to version 0.19.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.