A Server-Side Request Forgery vulnerability in the AliasVault API allows authenticated, low-privileged users to scan and interact with internal network infrastructure.

The application fails to properly validate destination hosts during favicon extraction, allowing an authenticated, low-privileged user to bypass security controls and reach internal loopback or private IP addresses. By manipulating the URL parameter, an attacker can coerce the backend to probe internal services and exfiltrate image-based data or map internal network topology.

The exploitation of this SSRF vulnerability poses a significant risk to the confidentiality of internal network segments. By enabling an attacker to pivot through the AliasVault server, an organization faces the risk of unauthorized reconnaissance of internal services that are otherwise shielded by firewalls. Given the CVSS score of 7.7, this is considered a High severity issue, as it facilitates lateral movement and potential exposure of sensitive internal metadata.

Immediate Action: Update AliasVault instances to version 0.23.1 or later immediately to incorporate the necessary input validation fixes for the favicon extraction feature.

Proactive Monitoring: Review application access logs for unusual outbound requests originating from the AliasVault API backend, specifically looking for attempts to access internal IP ranges or non-standard ports.

Compensating Controls: If immediate patching is not feasible, disable the favicon extraction feature or restrict the AliasVault server's ability to initiate outbound connections to internal network segments via network-level egress filtering.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a clear path for internal network reconnaissance and should be addressed as a priority. Administrators must verify their deployment type, and if the instance is exposed to the public internet with user registration enabled, the patch to version 0.23.1 must be applied immediately to prevent potential exploitation.