CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability in Pinry versions up to 2.1.13 allows unauthenticated remote attackers to exploit the pin-from-URL feature, enabling them to send HTTP requests to arbitrary internal or external hosts without proper validation. This could lead to unauthorized access to sensitive internal services or cloud metadata endpoints. Organizations using Pinry should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.