CyberRota Analysis
AI-GeneratedAuthenticated users with the `asset:import` permission in the Shelf platform prior to version 1.20.3 can exploit a Server-Side Request Forgery (SSRF) vulnerability via the Asset CSV Content Import feature, allowing attackers to send requests to internal network services and external hosts. This could lead to unauthorized access to sensitive internal resources and potential memory exhaustion due to unbounded response buffering. Organizations using affected versions should prioritize upgrading to version 1.20.3 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.