CVE-2024-4851 - CVE House
Back to Database
Status published High CVE-2024-4851

SSRF Vulnerability in stangirard/quivr

Vulnerability Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-4851

Credits & Attribution

No credits recorded in the NVD database.

References

More from stangirard

View All →
CVE-2024-9229
Denial of Service (DoS) via Multipart Boundary in stangirard/quivr
High 7.5
CVE-2024-6583
Path Traversal in stangirard/quivr
Medium 4.3
CVE-2024-6229
Stored XSS in stangirard/quivr
Medium 6.8
CVE-2024-5885
Server-Side Request Forgery (SSRF) in stangirard/quivr
High 8.6

Affected Vendor

Affected Software

stangirard/quivr
Vulnerable Versions:
unspecified

Timeline

Official Publish: June 6th, 2024
Last Modified: August 9th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery