CVE-2023-46725 is a high-severity (CVSS 8.1) Server-Side Request Forgery (SSRF) vulnerability in foodcoopshop/foodcoopshop. A fix is available for foodcoopshop/foodcoopshop — see the affected versions and patch details below.
FoodCoopShop Server-Side Request Forgery vulnerability
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-46725.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
foodcoopshop/foodcoopshopReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
There is a potential SSRF vulnerability in foodcoopshop. Since there is no security policy on your Github, I tried to use the emails to contact you.
The potential issue is in the Network module, where a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to arbitrary host. For example, use
data[data][0][remoteProductId]=352&data[data][0][image]=http://localhost:8888/
will make the server send a request to localhost:8888. This means that it can be used as a proxy into the internal network where the server is.
To make matters worse, the checks on valid image is not enough. There is time of check time of use issue there. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file at the redirect destination, making this a full SSRF. (An example python server that can do this is at https://pastebin.com/8K5Brwbq This will make the server download whatever at the redirect target)
You can check https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF, their impact and how to properly fix it.
Regards
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | foodcoopshop/foodcoopshop | ≥ 3.2.0&&< 3.6.1 | 3.6.1composer require foodcoopshop/foodcoopshop:^3.6.1 |
Affected Products
foodcoopshopfoodcoopshopDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for foodcoopshop/foodcoopshop, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update foodcoopshop/foodcoopshop to 3.6.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-46725 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Frequently Asked Questions
Is CVE-2023-46725 in your dependencies?
Find it across Packagist, including transitive dependencies.