CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.7.3 are vulnerable to a server-side request forgery (SSRF) flaw in the fetchPeerConnectInfo function, which allows authenticated attackers to exploit unvalidated HTTP requests. This vulnerability enables attackers to access internal services and cloud metadata endpoints by manipulating connection health checks or peer connection operations. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access to sensitive internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.