Server-side Request Forgery in Hackney by Hex

CVE-2025-1211

Summary

Hackney, a popular HTTP client library, is susceptible to Server-side Request Forgery (SSRF) which arises due to incorrect URL parsing by its URI module. The issue occurs when the library inappropriately determines the target host, leading to potential unauthorized access to server resources. For instance, an input URL like 'http://[email protected]/' can be misinterpreted, allowing attackers to exploit host verification weaknesses. It is crucial for developers relying on URL functions to ensure secure configurations to mitigate this risk.

References