CVE-2024-41813 HIGH

CVE-2024-41813: txtdot SSRF vulnerability in /proxy

Vendor Txtdot
Product txtdot
Weakness CWE-918 · SSRF
Published July 26, 2024
Last update August 12, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery (SSRF) vulnerability in the `/proxy` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.6.1 patches the issue.

Key dates

02Disclosure timeline

July 26, 2024 CVE published
August 12, 2024 Record updated