Skip to content
Threat Feed
Subscribe

Tag

Ech0

3 briefs RSS
high advisory

Ech0 Unauthenticated Server-Side Request Forgery Vulnerability

Ech0 is vulnerable to Server-Side Request Forgery (SSRF) due to an unauthenticated API endpoint (`/api/website/title`) that fetches website titles from user-controlled URLs, lacking proper validation and TLS verification, allowing attackers to access internal resources and potentially cause denial of service.

ssrf ech0 web-application
2r 1t 1i
high advisory

Ech0 Scoped Admin Access Token Bypass

Ech0 scoped access tokens do not reliably enforce least privilege, leading to privilege escalation and data exfiltration by allowing low-scope admin tokens to access broader admin functionality, including backup exports.

Ech0 privilege-escalation data-exfiltration access-token
2r 1t
high advisory

Ech0 Server-Side Request Forgery (SSRF) Vulnerability

Ech0 is vulnerable to Server-Side Request Forgery (SSRF) via the `fetchPeerConnectInfo` function, which uses `httpUtil.SendRequest` without SSRF protection, allowing authenticated users to make the server request arbitrary URLs, including internal/cloud metadata endpoints.

ech0 ssrf github
2r 1t 2i