Executive brief
SourceCodester SEO Meta Tag Extractor is a web application used to extract metadata from websites. A security vulnerability allows remote attackers to force the server to make unauthorized requests to internal systems or private network services. This could lead to the exposure of sensitive internal data, such as cloud infrastructure credentials or private administrative interfaces, which are normally protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the fetchMetaTags function within index.php of SourceCodester SEO Meta Tag Extractor 1.0. The application uses FILTER_VALIDATE_URL to check the user-supplied 'url' POST parameter but fails to restrict requests to private, loopback, or link-local IP ranges. The URL is passed directly to PHP's get_headers() and file_get_contents() functions. Because file_get_contents() follows HTTP redirects by default, attackers can also bypass simple blacklists using external redirectors. An unauthenticated remote attacker can exploit this to probe internal services, perform port scanning, or retrieve cloud metadata (e.g., AWS IMDS) and view the results via the extracted meta-tag output.
Affected products
- SourceCodester SEO Meta Tag Extractor 1.0
Timeline
- 2026-05-11: disclosed: Vulnerability discovered and documented by Kevin Chiang
- 2026-06-01: advisory: CVE-2026-10287 published