SSRF Vulnerability in Quivr Allowing Access to Internal Networks

CVE-2024-4851

Summary

The vulnerability in the Stangirard Quivr application arises from the inadequate validation of the 'url' parameter within the crawl endpoint. This flaw allows an attacker to manipulate this parameter to make HTTP requests to arbitrary URLs. Such SSRF attacks can lead to unauthorized interactions with internal services that are otherwise restricted, exposing sensitive data and resources to exploitation. The affected code is located in the backend/routes/crawl_routes.py file, specifically in the crawl_endpoint function. Proper validation of input parameters is crucial for mitigating such risks.

References