Executive brief
EverShop is an open-source e-commerce platform. An unauthenticated attacker can exploit a blind server-side request forgery (SSRF) vulnerability in the image handling API to force the server to make arbitrary HTTP requests to internal or external networks, potentially enabling reconnaissance, data exfiltration, or attacks against internal systems.
Technical details
A blind SSRF vulnerability exists in EverShop's GET /images API endpoint due to insufficient validation of the "src" query parameter. The parameter accepts arbitrary HTTP and HTTPS URIs without proper sanitization, allowing an unauthenticated attacker to craft requests that force the server to initiate HTTP requests to arbitrary targets. The vulnerability is classified as CWE-918 (Server-Side Request Forgery). An attacker can reach the vulnerable endpoint over the network with no authentication or user interaction required, enabling reconnaissance of internal infrastructure, data exfiltration from internal systems, or pivoting attacks within the victim's network.
Affected products
- EverShop EverShop 2.1.0 and prior
Timeline
- 2026-01-05: disclosed
- 2026-02-03: other: Last modification date in advisory database