blob: b7dc411e086a833adde58f17ad21e940e015db9f [file] [log] [blame]
- module:
- introduced: 1.2.0
fixed: 1.2.1
vulnerable_at: 1.2.0
summary: |-
Unchecked hostname resolution could allow access to local network resources by
users outside the local network
description: |-
### Impact A newly implemented route allowing users to download files from
remote endpoints was not properly verifying the destination hostname for user
provided URLs. This would allow malicious users to potentially access resources
on local networks that would otherwise be inaccessible.
This vulnerability requires valid authentication credentials and is therefore
**not exploitable by unauthenticated users**. If you are running an instance for
yourself or other trusted individuals this impact is unlikely to be of major
concern to you. However, you should still upgrade for security sake.
### Patches Users should upgrade to the latest version of Wings.
### Workarounds There is no workaround available that does not involve modifying
Panel or Wings code.
- GHSA-6rg3-8h8x-5xfv
- web:
- package:
- 'lint: redundant non-advisory reference to GHSA-6rg3-8h8x-5xfv'
- 'lint: summary is too long: 110 characters (max 100)'