Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-46354. PoCs published by Daniel Morales.
AI-analyzed exploit summary This is a writeup describing an SSRF vulnerability in Thinfinity VirtualUI versions prior to 2.5.26.2. The vulnerability allows an attacker to induce the application to interact with arbitrary external services, potentially leaking the real IP of the webserver or bypassing CDN protections.
Description
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
Exploits (1)
This is a writeup describing an SSRF vulnerability in Thinfinity VirtualUI versions prior to 2.5.26.2. The vulnerability allows an attacker to induce the application to interact with arbitrary external services, potentially leaking the real IP of the webserver or bypassing CDN protections.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N