Server-Side Request Forgery in Garlic-Hub

Executive Summary

CVE-2026-47170 is a Server-Side Request Forgery (SSRF) vulnerability in the garlic-hub software versions prior to 1.1. It exists in the uploadFromUrl endpoint, which allows authenticated users to make the server send arbitrary HTTP requests to internal services.

This means an attacker can perform internal port scanning, identify services running inside the network, and retrieve internal HTTP responses. These responses are then stored in a publicly accessible media pool, potentially exposing sensitive internal information.

The vulnerability was fixed in version 1.1 by adding strict URL validation to prevent requests to unauthorized internal or restricted network resources.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to cause the server to issue arbitrary HTTP requests to internal services, leading to internal port scanning, service fingerprinting, and retrieval of internal HTTP responses. These responses are stored in a publicly accessible media pool, potentially exposing sensitive internal information.

Such exposure of internal data could lead to unauthorized access to sensitive information, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding sensitive and personal data from unauthorized disclosure.

Therefore, if exploited, this vulnerability could result in non-compliance with these standards due to the risk of data leakage and insufficient protection of internal network information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts including unauthorized access to internal network services and sensitive data.

• Internal port scanning by attackers to discover network services.
• Service fingerprinting to identify software and versions running internally.
• Retrieval and public exposure of internal HTTP responses, potentially leaking sensitive information.

Because the internal responses are stored in a publicly accessible media pool, attackers or unauthorized users could access sensitive data that should remain private.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows authenticated users to cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. Detection can focus on monitoring for unusual or unauthorized HTTP requests originating from the garlic-hub server to internal network services.

One approach is to check the publicly accessible media pool for unexpected or suspicious HTTP response data that may indicate internal service responses being stored.

Network monitoring tools or logs can be used to detect internal port scanning or service fingerprinting activities initiated by the garlic-hub server.

• Use network packet capture tools like tcpdump or Wireshark to monitor outgoing HTTP requests from the garlic-hub server to internal IP ranges.
• Example tcpdump command to capture HTTP requests from the garlic-hub server to internal network: tcpdump -i <interface> 'tcp port 80 and src host <garlic-hub-server-ip>'
• Check the media pool directory or database for stored HTTP responses that could indicate exploitation.
• Review garlic-hub server logs for usage of the uploadFromUrl endpoint by authenticated users.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade garlic-hub to version 1.1 or later, where the vulnerability has been patched.

If upgrading immediately is not possible, disable the uploadFromUrl endpoint to prevent exploitation.

The patch includes a SsrfValidator that validates URLs before processing, blocking access to internal or restricted network resources. Applying this patch or equivalent validation logic is critical.

Useful 0 Not Useful 0