Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering. Details In got.scpaping, Summaly first makes a HTTP HEAD request to the page being summarized. It then preforms private IP address checks on the HEAD response, then makes an additional HTTP GET request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the GET response, the GET response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly. PoC With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address: Impact Using this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to…
Recommended action: Upgrade to 5.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Details In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new scrapingOptions object is not provided the allowRedirects property of opts. PoC - Publish a post containing a link to any URL that redirects on Misskey. - A preview will be generated for the target of the redirect, despite Misskey passing allowRedirects: false. Impact Misskey will follow redirects, despite explicitly requesting not to.
Recommended action: Upgrade to 5.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.