Keeper.Sh Calendar Module
An authenticated attacker can bypass the server-side request forgery (SSRF) guard to access private network addresses. This is achieved through a DNS rebinding attack targeting the two-phase URL validation and connection flow. The system validates the resolved IP addresses of a hostname but discards them before opening the HTTP connection. An attacker controlling authoritative DNS can provide a public address during the validation phase and a private address during the subsequent socket-level DNS resolution, allowing the connection to reach internal infrastructure, such as cloud instance metadata endpoints.