{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mistralrs-server-core--0.8.17/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mistralrs-server-core (\u003c= 0.8.17)"],"_cs_severities":["high"],"_cs_tags":["ssrf","file-enumeration","denial-of-service","webserver"],"_cs_type":"advisory","_cs_vendors":["mistral.rs"],"content_html":"\u003cp\u003eThe mistral.rs project contains a critical vulnerability in the \u003ccode\u003emistralrs-server-core\u003c/code\u003e crate (versions 0.8.17 and earlier) that exposes server infrastructure to SSRF and filesystem enumeration. During chat completion requests, the server uses a \u003ccode\u003eparse_image_url\u003c/code\u003e and \u003ccode\u003eparse_audio_url\u003c/code\u003e utility to process media URLs. This utility fails to perform any host validation or IP allowlisting, allowing remote, unauthenticated attackers to supply \u003ccode\u003ehttp(s)\u003c/code\u003e URLs that resolve to internal network addresses or cloud metadata services.\u003c/p\u003e\n\u003cp\u003eFurthermore, the parser accepts \u003ccode\u003efile://\u003c/code\u003e schemes or bare file paths. If a path exists on the local filesystem, the server attempts to open and process it. Because the server returns distinct error messages for valid vs. nonexistent paths, attackers can use the application as an oracle to enumerate the existence and type of files on the server. The vulnerability also enables resource exhaustion (Denial of Service) due to the lack of request timeouts and file size limits during the fetching and reading process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a crafted POST request to the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request includes a \u003ccode\u003emessages\u003c/code\u003e object containing a malicious \u003ccode\u003eimage_url\u003c/code\u003e or \u003ccode\u003eaudio_url\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emistralrs-server-core\u003c/code\u003e backend passes this unvalidated string to \u003ccode\u003eparse_image_url\u003c/code\u003e or \u003ccode\u003eparse_audio_url\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor SSRF: The backend uses \u003ccode\u003ereqwest::get\u003c/code\u003e to fetch the attacker-supplied URL, following redirects to internal or cloud-metadata destinations.\u003c/li\u003e\n\u003cli\u003eFor File Enumeration: The backend attempts \u003ccode\u003eFile::open\u003c/code\u003e on the provided string; success confirms file existence, triggering an image decoding error.\u003c/li\u003e\n\u003cli\u003eThe server returns a specific HTTP 500 error response reflecting the outcome of the filesystem operation.\u003c/li\u003e\n\u003cli\u003eThe attacker parses the error response to confirm file existence or probe internal network services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to probe internal networks, including sensitive cloud metadata services, and enumerate files on the host filesystem. While actual file content disclosure is not directly achieved, the existence oracle provides significant information for lateral movement or further exploitation. Additionally, the lack of input constraints enables a Denial of Service attack by forcing the server to process oversized files or hang on non-responsive internal network requests.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate \u003ccode\u003emistralrs-server-core\u003c/code\u003e to a version that implements input validation and restricts media loading.\u003c/li\u003e\n\u003cli\u003eImplement strict allowlists for media domains and block access to private/loopback/link-local IP ranges and cloud metadata services.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to inspect \u003ccode\u003eimage_url\u003c/code\u003e and \u003ccode\u003eaudio_url\u003c/code\u003e parameters for \u003ccode\u003efile://\u003c/code\u003e schemes or suspicious local file paths (e.g., \u003ccode\u003e/etc/\u003c/code\u003e, \u003ccode\u003eC:\\\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eEnsure appropriate resource limits and timeouts are configured for the request-handling service to mitigate potential Denial of Service exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-11T00:54:43Z","date_published":"2026-09-11T00:54:43Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mistralrs-ssrf-local-file-read/","summary":"The mistralrs-server-core component allows unauthenticated attackers to perform SSRF and enumerate local files via unvalidated image_url and audio_url message parameters.","title":"Unauthenticated SSRF and Local File Enumeration in mistral.rs","url":"https://feed.craftedsignal.io/briefs/2026-09-mistralrs-ssrf-local-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Mistralrs-Server-Core (\u003c= 0.8.17)","version":"https://jsonfeed.org/version/1.1"}