CyberRota Analysis
AI-GeneratedThe vulnerability affects Gitingest versions up to 0.3.1, allowing improper hostname validation that permits attackers to exploit URLs with malicious hostnames prefixed by git., gitlab., or github. This flaw can lead to unauthorized outbound connections and the exposure of GitHub personal access tokens through HTTP basic authentication. Organizations utilizing Gitingest for integration with GitLab or GitHub should prioritize patching this vulnerability to mitigate the risk of credential leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.