Imgproxy Server SSRF Vulnerability Allowing Access to Local Services

A server-side request forgery (SSRF) vulnerability has been identified in Imgproxy, a tool for resizing and processing images. The issue arises because Imgproxy does not block requests to the loopback address '0.0.0.0', even when the 'IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES' configuration is set to false. This oversight can expose local host services to potential access. The vulnerability affects all versions of Imgproxy prior to 3.27.2.

Impact

Exploitation of this vulnerability could lead to unauthorized access to services running on the local host.

Remediation

Users can upgrade to Imgproxy version 3.27.2 or later to address this vulnerability.