Grist-Core Server-Side Request Vulnerability Allowing Privileged Network Access

A vulnerability in Grist-Core prior to version 1.7.6 allows users with access to any document to execute server-side URL fetches. This capability could be exploited to escalate attacks by leveraging the privileged network access of these requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access or manipulation of network resources, potentially allowing for further escalation of attacks.

Remediation

Users are advised to upgrade to Grist-Core version 1.7.6 or later. For those unable to upgrade, avoid making HTTP or HTTPS endpoints available that expose credentials or operate without them.