CVE-2023-41055

Summary

CVE-2023-41055 is a Server-Side Request Forgery (SSRF) vulnerability affecting LibreY, a privacy-respecting meta search engine. The flaw resides in the `engines/google/text.php` and `engines/duckduckgo/text.php` files and impacts versions prior to commit be59098abd119cda70b15bf3faac596dfd39a744. This flaw enables remote attackers to issue HTTP GET requests to arbitrary targets, potentially leading to Denial-of-Service (DoS) attacks. Attackers can request the server to download large files or even deny access to legitimate users, reducing the server's performance. The issue has been addressed in the latest commit available at https://github.com/Ahwxorg/LibreY/pull/9. LibreY hosts are urged to upgrade to the latest version, and no known workarounds for this vulnerability have been identified.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.