Ladder 0.0.21 Server-Side Request Forgery

Ladder versions 0.0.1 through 0.0.21 fail to apply sufficient default restrictions on destination addresses, allowing an attacker to make GET requests to addresses that would typically not be accessible from an external context. An attacker can access private address ranges, locally listening services, and cloud instance metadata APIs.

access address addresses apis attacker can cloud context default external fail forgery instance listening locally metadata private request requests restrictions server server-side request forgery services