{"uuid": "8be7a164-02d0-44e4-9557-f90f9360a367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-1211", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/7712", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-1211\n\ud83d\udd25 CVSS Score: 6.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P)\n\ud83d\udd39 Description: Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.\n\ud83d\udccf Published: 2025-02-11T05:00:00.994Z\n\ud83d\udccf Modified: 2025-03-16T12:48:56.614Z\n\ud83d\udd17 References:\n1. https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131\n2. https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1\n3. https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf\n4. https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a", "creation_timestamp": "2025-03-16T13:49:26.000000Z"}