CyberRota Analysis
AI-GeneratedHugo versions 0.91.0 to 0.162.0 are vulnerable due to improper validation of intermediate URLs during HTTP 3xx redirects, allowing an attacker to redirect requests to unauthorized hosts. This could lead to the exposure of sensitive data or the fetching of malicious content, bypassing any host restrictions set by the operator. Users of affected Hugo versions, particularly those handling sensitive information or operating in security-conscious environments, should prioritize upgrading to version 0.162.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)