IP address leak via image proxy bypass in Zulip Server
CVE-2022-36048

4.3MEDIUM

Key Information:

Vendor

Zulip

Status
Zulip
Vendor
CVE Published:
31 August 2022

What is CVE-2022-36048?

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews disabled are not affected.

Affected Version(s)

zulip < 5.6

References

https://github.com/zulip/zulip/security/advisories/GHSA-v...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.