CyberRota Analysis
AI-GeneratedVersions of Snipe-IT prior to 8.7.0 are vulnerable to a server-side request forgery (SSRF) flaw that allows super-admin users to exploit the ExternalUrl validation rule. By leveraging IPv6 transition addresses, attackers can bypass security measures and gain unauthorized access to internal services or cloud metadata endpoints. Organizations using affected versions should prioritize patching to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access internal services or cloud metadata endpoints.
Related CVEs
Other vulnerabilities affecting the same vendor(s)