CyberRota Analysis
AI-GeneratedNango versions up to 0.70.4 are vulnerable due to inadequate validation of user-supplied connection configuration values, allowing authenticated attackers to inject malicious configurations. This flaw can lead to unauthorized server requests targeting internal addresses or cloud metadata endpoints, potentially resulting in the exfiltration of sensitive provider credentials. Organizations using Nango should prioritize patching this vulnerability to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.