CyberRota Analysis
AI-GeneratedVersions of stoatchat prior to 0.15.0 are vulnerable due to inadequate blocking of the IPv6 unspecified address (::) in the SSRF blocklist, enabling unauthenticated attackers to exploit the /proxy and /embed endpoints. This vulnerability allows attackers to craft requests that access internal services on the loopback interface, potentially exposing sensitive content. Organizations using affected versions should prioritize updating their software to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.