CVE-2026-30247
SSRF via HTTP Redirects in WeKnora Document Import Feature
Publication date: 2026-03-07
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tencent | weknora | to 0.2.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-30247 is a Server-Side Request Forgery (SSRF) vulnerability in the WeKnora framework\'s "Import document via URL" feature prior to version 0.2.12.'}, {'type': 'paragraph', 'content': 'Although the backend validates the initial URL to block private IPs, loopback addresses, reserved hostnames, and cloud metadata endpoints, it does not validate the targets of HTTP redirects.'}, {'type': 'paragraph', 'content': 'An attacker can exploit this by submitting a URL that passes initial validation but responds with an HTTP redirect to internal services, including Docker-specific internal addresses like host.docker.internal.'}, {'type': 'paragraph', 'content': "Because the backend's HTTP client automatically follows redirects without re-validating them, the server can be tricked into accessing internal resources that should be protected."}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to internal services and sensitive data.
- Access to internal databases such as PostgreSQL, MongoDB, and MySQL.
- Disclosure of information from internal caches and configuration servers like Redis.
- Exposure of Docker container metadata and environment variables.
- Potential lateral movement within the Docker network.
- Exfiltration of sensitive data including API keys and credentials.
- Possible remote code execution if internal services are vulnerable.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this SSRF vulnerability involves monitoring and analyzing requests to the vulnerable endpoint and observing any unexpected internal service access triggered by redirects.'}, {'type': 'paragraph', 'content': 'Specifically, you can check for POST requests to the endpoint `/api/v1/knowledge-bases/{id}/knowledge/url` that include URLs which cause HTTP 3xx redirects to internal Docker addresses such as `host.docker.internal` or IP ranges like `172.17.0.0/16`.'}, {'type': 'paragraph', 'content': 'Network monitoring tools or proxy logs can be used to detect such redirect chains.'}, {'type': 'list_item', 'content': 'Use curl with verbose output to test URL import behavior and observe redirects, for example: `curl -v -X POST -d \'{"url":"http://attacker.com/redirect"}\' https://your-weknora-instance/api/v1/knowledge-bases/{id}/knowledge/url`'}, {'type': 'list_item', 'content': 'Use network packet capture tools like tcpdump or Wireshark to monitor outgoing HTTP requests from the server to internal IPs or Docker-specific addresses.'}, {'type': 'list_item', 'content': 'Check application logs for any requests that follow redirects to internal services or unusual access patterns.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade the WeKnora application to version 0.2.12 or later, where the vulnerability has been patched by adding validation for redirect targets and blocking Docker-specific internal addresses.'}, {'type': 'paragraph', 'content': 'Until the upgrade can be applied, consider the following immediate steps:'}, {'type': 'list_item', 'content': 'Disable or restrict the "Import document via URL" feature to trusted users or networks.'}, {'type': 'list_item', 'content': 'Implement network-level controls such as firewall rules to block outbound HTTP requests from the application server to internal Docker IP ranges (e.g., 172.17.0.0/16) and Docker hostnames like `host.docker.internal`.'}, {'type': 'list_item', 'content': 'Monitor and alert on any HTTP requests from the application server to internal services that are not expected.'}, {'type': 'list_item', 'content': 'Review and harden internal service access controls to minimize impact if SSRF is exploited.'}] [1]