Tomás Illuminati

A server-side request forgery (SSRF) issue exists in the crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling due to insufficient validation of the destination host. This allows the crawler to make direct HTTP(S) requests to restricted addresses, such as loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services like 169.254.169.254. Manual crawler tasks bypass the domain blacklist because they are assigned a non-zero priority, and IP literals are fetched directly instead of using a proxy. An attacker can use the server as a network pivot to access internal services. Since the crawler interface provides access to the resulting HTML, screenshots, and HAR data, the SSRF is non-blind, potentially leading to the disclosure of sensitive internal data, service information, or cloud instance credentials.

A path traversal issue allows an authenticated user to supply crafted object identifiers through the investigation workflow, causing file paths to resolve outside the intended image, favicon, or screenshot storage directories. This occurs because user-controlled path components are joined with application storage paths without verifying that the resolved path remains within the expected directory. Consequently, an attacker can download and read arbitrary files accessible to the AIL process via the affected download functionality, which may include these files in a generated archive.