CyberRota Analysis
AI-GeneratedThe vulnerability exists in the jina-ai reader, which is susceptible to server-side request forgery due to inadequate URL validation during redirect hops. This flaw enables attackers to exploit crafted public URLs to access internal network addresses or cloud metadata endpoints, potentially exposing sensitive data. Organizations utilizing this product should prioritize remediation efforts to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.