GitHub Advisoryadvisory · Hex

GHSA-vq52-99r9-h5pw Server-side Request Forgery (SSRF) in hackney

LOW Published 2025-02-11 Modified 2025-02-20 Official page ↗
Aliases
CVE-2025-1211
Ecosystem
Hex
Packages
hackney
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2025-02-11

Affected packages

• Hex hackney: < 1.21.0 → fixed in 1.21.0

Description

Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://[email protected]/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.

Related

Alias · CVE (1)

  • CVE-2025-1211 Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References