CyberRota Analysis
AI-GeneratedLaravel-Mediable versions prior to 7.0.0 are vulnerable to a server-side request forgery (SSRF) that enables remote attackers to send arbitrary HTTP requests from the server. This flaw can be exploited to access internal resources, including sensitive files and cloud metadata, potentially leading to the exfiltration of critical credentials like IAM tokens. Organizations using affected versions should prioritize patching this vulnerability to safeguard their internal infrastructure and sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.