CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.16 is vulnerable to a server-side request forgery (SSRF) that enables attackers to exploit DNS rebinding to bypass hostname validation during webhook delivery. This vulnerability allows unauthorized access to internal network resources by manipulating DNS responses, posing a risk to systems that rely on this plugin for webhook functionality. Organizations using the Grav API plugin should prioritize updating to the latest version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.