PT-2026-51760 · Unknown · Pentestify
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Pentestify versions 1.0.0 and earlier
Description
A Server-Side Request Forgery (SSRF) exists in the PDF generation endpoint "GET /api/reports/{id}/pdf" (backend/main.py). This occurs because the target URL is constructed using
request.base url without proper validation. A remote attacker can use a crafted Host header to force the server to make requests to arbitrary internal or external URLs, including cloud metadata services, and receive the rendered content within the generated PDF.Recommendations
Update Pentestify to a version later than 1.0.0.
As a temporary mitigation, restrict access to the "GET /api/reports/{id}/pdf" endpoint.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pentestify