Executive brief
Chartbrew, an open-source data visualization platform, is vulnerable to a security flaw that allows users to force the server to make unintended network requests. An attacker with a valid account could use this to access sensitive internal company data, scan private networks, or steal cloud service credentials (like AWS metadata). This could lead to a full compromise of the cloud environment or unauthorized access to internal databases and services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Chartbrew's ConnectionController. The application uses the 'request-promise' library to fetch user-provided URLs for API data connections without implementing IP address validation or blocklists. An authenticated attacker can provide URLs pointing to internal IP ranges (e.g., 10.0.0.0/8) or cloud metadata services (e.g., 169.254.169.254). This allows for the exfiltration of sensitive information such as IAM credentials or interaction with internal services that are not exposed to the public internet. The vulnerability is fixed in version 4.8.5 by introducing a private network request flag.
Affected products
- Chartbrew Chartbrew < 4.8.5
Timeline
- 2026-03-05: patched: Fix committed to repository
- 2026-04-10: disclosed: Initial advisory published
- 2026-04-10: advisory: GitHub Security Advisory published