CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to exploit the system by registering a webhook URL that points to internal network addresses. This flaw enables attackers to make the server issue HTTP requests to potentially sensitive internal resources, posing a risk of unauthorized access to internal systems. Organizations using this version of Apioo Fusio should prioritize remediation, particularly those with sensitive internal services exposed to authenticated users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.