GHSL-2023-225: , GHSL-2023-226, GHSL-2023-227, and GHSL-2023-228: Server-Side Request Forgery (SSRF) and Denial of Service (DoS) in Mealie - CVE-2024-31991, CVE-2024-31992, CVE-2024-31993, CVE-2024-31994
Published Apr 12, 2024
·Updated
Mealie v1.0.0-RC1.1 is vulnerable to multiple SSRF and DoS vulnerabilities. These vulnerabilities can be leveraged to identify, map, and retrieve the contents of webservers on Mealie’s local network as well as being the victim of, or launching point for, a denial of service attack against a target of the attacker’s choice.
Affected Software
1 affected component
Mealie=1.0.0-RC1.1
Event History
Apr 12, 2024
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What could an attacker reach through the affected instance?
The SSRF issues can be used to identify, map, and retrieve content from webservers on Mealie’s local network. This could expose services that are not directly reachable by the attacker.
2
How can the denial-of-service issues be used?
The affected Mealie instance can be used as the victim of a denial-of-service attack or as a launching point to target a service chosen by the attacker.