{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/zrok--0.4.47--1.1.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zrok (\u003e= 0.4.47, \u003c= 1.1.11)"],"_cs_severities":["critical"],"_cs_tags":["ssrf","cve","cve-2026-45568","zrok","proxyshare"],"_cs_type":"advisory","_cs_vendors":["pip"],"content_html":"\u003cp\u003eThe zrok Python SDK, specifically the \u003ccode\u003eProxyShare\u003c/code\u003e functionality, is susceptible to a server-side request forgery (SSRF) vulnerability, identified as CVE-2026-45568. This flaw exists due to the use of \u003ccode\u003eurllib.parse.urljoin\u003c/code\u003e without proper sanitization of the input path. An attacker can exploit this by crafting a request containing an absolute URL in the path. The Flask handler then passes this malicious path to \u003ccode\u003eurljoin\u003c/code\u003e, which incorrectly combines it with the target URL. This results in the proxy forwarding the request to an attacker-controlled server instead of the intended target, potentially leading to information disclosure or internal network access. The vulnerability affects zrok versions 0.4.47 through 1.1.11. This matters for defenders because it allows an attacker to bypass intended access controls and potentially gain access to internal resources.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAlice configures a zrok \u003ccode\u003eProxyShare\u003c/code\u003e with a defined target URL, for example, \u003ccode\u003ehttps://internal-api.example.com\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBob identifies the exposed \u003ccode\u003eProxyShare\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eBob crafts a malicious request to the \u003ccode\u003eProxyShare\u003c/code\u003e endpoint, including an absolute URL in the path, such as \u003ccode\u003e/http://127.0.0.1:19190/metadata\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Flask application routes the request to the \u003ccode\u003eproxy\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eproxy\u003c/code\u003e function uses \u003ccode\u003eurllib.parse.urljoin(self.target, path)\u003c/code\u003e to construct the outbound URL. Due to the absolute URL in \u003ccode\u003epath\u003c/code\u003e, \u003ccode\u003eurljoin\u003c/code\u003e resolves to \u003ccode\u003ehttp://127.0.0.1:19190/metadata\u003c/code\u003e instead of a URL on Alice\u0026rsquo;s intended target.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003erequests.request\u003c/code\u003e function sends the crafted request to the attacker-controlled URL (\u003ccode\u003ehttp://127.0.0.1:19190/metadata\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s server (\u003ccode\u003e127.0.0.1:19190\u003c/code\u003e) receives the request, potentially including sensitive information or internal headers.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s server responds, and the response is relayed back to Bob, completing the SSRF attack.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-45568 allows an attacker to perform SSRF attacks against zrok deployments. This can enable the attacker to access internal services, read sensitive data from internal endpoints, or potentially perform actions on behalf of the zrok server. The impact can range from information disclosure to full compromise of internal systems, depending on the services accessible from the zrok server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade zrok to a version beyond 1.1.11 to patch CVE-2026-45568.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect zrok SSRF Attempt via Absolute URL in Request Path\u0026rdquo; to detect exploitation attempts against vulnerable zrok instances.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests containing absolute URLs in the path to the zrok proxy endpoint to identify potential SSRF attempts, referencing the attack chain described above.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-19T15:16:52Z","date_published":"2026-05-19T15:16:52Z","id":"https://feed.craftedsignal.io/briefs/2026-05-zrok-ssrf/","summary":"The zrok Python SDK `ProxyShare` is vulnerable to server-side request forgery (SSRF) via CVE-2026-45568. When a user sends a request with an absolute URL in the path, the Flask handler passes that path to `urllib.parse.urljoin`, which replaces the configured target host with the user-supplied host, causing the proxy to send the request to an attacker-chosen URL.","title":"zrok ProxyShare SSRF Vulnerability (CVE-2026-45568)","url":"https://feed.craftedsignal.io/briefs/2026-05-zrok-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed — Zrok (\u003e= 0.4.47, \u003c= 1.1.11)","version":"https://jsonfeed.org/version/1.1"}