Frappe Builder before 1.36.1 SSRF via convert_to_webp
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.36.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Frappe Builder, a visual website and page builder for the Frappe framework, is affected by this flaw. An authenticated user with low privileges could make the server fetch internal network resources or cloud metadata, and the retrieved data could be exposed through publicly accessible file links, leading to data leakage and probing of internal systems.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- frappe builder
From 1.0.0 · fixed in 1.36.1