Unauthenticated SSRF in Buku (bukuserver) via URL Parameter

Executive Summary

CVE-2026-123201 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Buku bookmark manager's bukuserver component through version 5.1.1. It allows remote attackers to make the server request internal hosts by supplying a malicious url parameter to /api/fetch_data or /api/network_handle endpoints. The vulnerability bypasses weak URL validation checks, enabling access to loopback, private, or cloud metadata IP addresses. Attackers can discover internal services and extract metadata such as page titles, descriptions, and keywords.

Useful 0 Not Useful 0

Detection Guidance

Check if your Buku server (bukuserver) is publicly accessible and test the vulnerable endpoints /api/fetch_data or /api/network_handle by sending requests with internal IP addresses or URLs. Use curl commands like: curl -X POST http://<server>/api/fetch_data -d 'url=http://127.0.0.1' or curl -X POST http://<server>/api/network_handle -d 'url=http://169.254.169.254/latest/meta-data/' to verify if the server responds with internal service data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to force the server to make outbound HTTP(S) requests to internal or restricted services. If the server is publicly accessible without authentication, attackers could access sensitive internal services, cloud metadata endpoints, or private IP addresses. This may lead to information disclosure, such as reading page titles or descriptions of internal web pages, potentially exposing sensitive data or internal network structure.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may result in unauthorized data processing or disclosure, violating principles of data protection and user consent. For HIPAA, unauthorized access to internal services could compromise protected health information (PHI) confidentiality. Both regulations require strict access controls and protection of sensitive data, which this vulnerability undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Buku to a patched version where IP-based URL fetching is disabled by default. Set the environment variable BUKUSERVER_FETCH_BY_IP=false or ensure the configuration option is disabled. Restrict public access to the bukuserver endpoints if not required. Monitor logs for suspicious requests to /api/fetch_data or /api/network_handle.

Useful 0 Not Useful 0