Description
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| picosh | pico | ≤ 4.1.2 | — |
References
- GitHub Issue #229 issue-tracking
- https://github.com/picosh/pico product
- https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358 technical-description
- https://github.com/picosh/pico/commit/48a85d6 patch
- VulnCheck Advisory: Pico through 4.1.2 SSRF in Feeds Service via run SSH Command third-party-advisory