Tag

Ech0

2 briefs RSS

Ech0 Unauthenticated Server-Side Request Forgery Vulnerability

Ech0 is vulnerable to Server-Side Request Forgery (SSRF) due to an unauthenticated API endpoint (`/api/website/title`) that fetches website titles from user-controlled URLs, lacking proper validation and TLS verification, allowing attackers to access internal resources and potentially cause denial of service.

ssrf ech0 web-application

2r 1t 1i Apr 3, 2026

high advisory

Ech0 Server-Side Request Forgery (SSRF) Vulnerability

2 rules 1 TTP 2 IOCs

Ech0 is vulnerable to Server-Side Request Forgery (SSRF) via the `fetchPeerConnectInfo` function, which uses `httpUtil.SendRequest` without SSRF protection, allowing authenticated users to make the server request arbitrary URLs, including internal/cloud metadata endpoints.

ech0 ssrf github

2r 1t 2i Jan 2, 2024