Cpe:2.3:a:fider:fider:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afiderfider/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:10:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFider: Server-Side Request Forgery via webhook configuration (CVE-2026-65967)https://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/Wed, 11 Nov 2026 20:10:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/Fider versions before 0.34.0 are vulnerable to Server-Side Request Forgery (SSRF) in the webhook functionality, allowing authenticated administrators to perform unauthorized requests against internal network resources.Fider versions prior to 0.34.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The application fails to properly validate user-supplied URLs within its webhook configuration feature. An attacker with administrative privileges can supply arbitrary URLs, forcing the Fider server to initiate HTTP requests to restricted internal network resources or cloud provider metadata services (e.g., IMDS). This issue is addressed in Fider version 0.34.0.

Impact

Successful exploitation allows an administrative user to bypass network access controls, potentially leading to unauthorized interaction with internal services or the exfiltration of sensitive cloud instance metadata. This impacts the confidentiality and accessibility of internal network infrastructure.

Recommendation

Upgrade all Fider installations to version 0.34.0 or later immediately. As a compensating control, ensure the Fider server is deployed within a network segment that strictly limits outbound access to only required external endpoints and blocks access to internal network ranges and cloud metadata service IP addresses (e.g., 169.254.169.254).

]]>highadvisory