CyberRota Analysis
AI-GeneratedPixelfed's SearchController is vulnerable to server-side request forgery (SSRF) due to inadequate validation of URLs provided through its remote-search parameters, allowing logged-in users to potentially access internal resources by bypassing restrictions on IP ranges. The impact includes the possibility of exposing sensitive data or services within the network, as the fetch response is returned based on content type validation. Organizations using Pixelfed should prioritize addressing this vulnerability, particularly those with sensitive internal services accessible from the same network.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254).