CVE-2024-1063

Vulnerability

Appwrite versions up to and including v1.4.13 are vulnerable to a Server-Side Request Forgery (SSRF) attack via the /v1/avatars/favicon endpoint. This vulnerability is a bypass of an incomplete fix for CVE-2023-27159 [1]. An attacker can exploit this to make the server send requests to arbitrary internal or external hosts.

Exploitation

An unauthenticated attacker with network access to the Appwrite instance can send a crafted request to the /v1/avatars/favicon endpoint, specifying a target URL. The server will then initiate a request to that URL, allowing the attacker to probe internal services, read response data, or perform further attacks [1].

Impact

Successful exploitation allows the attacker to perform SSRF, enabling reconnaissance of internal network services, potential information disclosure, and possibly leveraging the server's trust to access restricted resources [1].

Mitigation

Upgrade to Appwrite version 1.5.0 or later, which contains the fix for this vulnerability [1]. No workaround has been publicly disclosed.