Vulnerability feed

Executive summary

Event Schedule, an open-source platform for sharing events and selling tickets, has a server-side request forgery flaw in its import URL check. An authenticated user with a curator role could use it to reach internal or localhost services through event import. The advisory rates it Moderate with a CVSS 3.1 base score of 6.5, and the stated fix is to strip brackets from IPv6 hosts, fail closed on DNS resolution failures, and pin validated IPs. Patched versions are stated as None.

Technical summary

The flaw is a server-side request forgery (CWE-918) in App\Utils\UrlUtils::isUrlSafe(), which is meant to block unsafe import URLs. Bracketed IPv6 literals such as http://[::1]:6379/ bypass the IPv6 checks because parse_url keeps the brackets, and a hostname with only an AAAA record fails open because the IPv4-only resolver skips the private-IP check. The attack requires an authenticated user with a curator role who can supply import_urls, and the attacker can read internal responses surfaced in events. Affected versions are stated as <= 1.0.0 and patched versions as None, so no fixed version is stated. The advisory gives remediation guidance but no workaround, and it does not state whether exploitation in the wild has occurred or provide detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/eventschedule/eventschedule/…/GHSA-664j-55hw-p8fm

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affects

eventscheduleeventschedule