CyberRota Analysis
AI-GeneratedWyoming versions prior to 1.10.2 are vulnerable to a server-side request forgery (SSRF) flaw that enables unauthenticated attackers to manipulate outbound connections by injecting malicious `uri` query parameters into specific HTTP API endpoints. This vulnerability can lead to unauthorized access to internal services and data exfiltration, posing a significant risk to network security. Organizations using affected versions should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.