GHSL-2023-227: GHSL-2023-225, GHSL-2023-226, GHSL-2023-227, and GHSL-2023-228: Server-Side Request Forgery (SSRF) and Denial of Service (DoS) in Mealie - CVE-2024-31991, CVE-2024-31992, CVE-2024-31993, CVE-2024-31994
Mealie v1.0.0-RC1.1 is vulnerable to multiple SSRF and DoS vulnerabilities. These vulnerabilities can be leveraged to identify, map, and retrieve the contents of webservers on Mealie’s local network as well as being the victim of, or launching point for, a denial of service attack against a target of the attacker’s choice.
Affected Software
Event History
Frequently Asked Questions
Which deployments face the greatest exposure from this issue?
Deployments of Mealie v1.0.0-RC1.1 that can reach internal or local-network web servers are exposed to SSRF-based network discovery and content retrieval. The same deployment may also be used as the source or target of a denial-of-service attack.
What could an attacker do through the affected instance?
An attacker could use the vulnerabilities to identify and map web servers on Mealie’s local network and retrieve their contents. They could also cause or launch denial-of-service activity against a target of their choice.