Description (CNA)
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| keephq / keep | affected 0 through 91c75e0 |
CWE
CWE-918
References
- https://github.com/keephq/keep/issues/6630
- https://github.com/keephq/keep
- https://www.vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck
ADP enrichment
No English description supplied.