CVE-2025-1211CWE-918

Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and…

Medium · published February 11, 2025

CVSS v4.0
6.3
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://[email protected]/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-02-11T05:00Z
EPSS history
Timeline
  • 11 FEB 05:00Z
    Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and…
    cvelistv5