Security Update
- Fixed an authenticated SSRF (server-side request forgery) in the game asset update endpoint. The URL allowlist was validated with a different parser than the one used to fetch the asset, so a crafted URL could pass the SteamGridDB host check while causing the server to issue requests to arbitrary internal hosts and ports. Reported by @wenbo222
If you run Fireshare with LDAP auth enabled, this is exploitable by any logged-in user (including non-admins), so updating to v1.7.9 is highly recommended. Without LDAP, the endpoint requires an admin account, but upgrading is still advised.
Contributors
wenbo222