Chaskiq: Server-side request forgery in createUrlUpload GraphQL mutation

Summary

Chaskiq up to and including version 2.0.3 contains a server-side request forgery (SSRF) flaw in the createUrlUpload GraphQL mutation, reachable via POST /graphql. An unauthenticated attacker can make the server fetch arbitrary URLs, including internal addresses and cloud instance metadata endpoints. The response can be read back through the returned ActiveStorage blob URL, which may expose credentials or internal data.

Affected

• Chaskiq through 2.0.3 (CVE record: versions 0 to 2.0.3 affected)

Fixed in

Unknown. No vendor advisory or fixed release was found.

Workaround

• No vendor-documented workaround.
• Block outbound requests from the application server to internal networks and metadata addresses.
• Restrict or block access to /graphql at a reverse proxy or WAF where feasible.
• If the createUrlUpload mutation is not needed, disable it.
• Enforce IMDSv2 on AWS. This limits metadata abuse but does not fix the SSRF.

Exploitation

• Not known to be exploited in the wild.
• Public proof-of-concept status is disputed: CISA ADP SSVC lists exploitation as 'poc' and automatable as 'yes', while VulDB states no exploit is available.
• Assume low-skill attackers could reach a public write-up.

Our recommendation

• Inventory all Chaskiq instances, including forks and Docker images, and check their versions.
• Treat internet-facing instances at version 2.0.3 or older as urgent.
• Apply the mitigations above now and check the GitHub repository for a fixed release. Do not assume any version is safe.
• Restrict outbound traffic from the server and review logs for POST /graphql requests calling createUrlUpload and unusual blob access.
• Audit other unauthenticated GraphQL mutations in the same codebase.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE JSON record raw.githubusercontent.com
• Chaskiq graphql_controller.rb at 2.0.3 github.com
• Chaskiq create_url_upload.rb at 2.0.3 github.com
• VulnCheck advisory www.vulncheck.com
• Write-up (HackMD) hackmd.io
• HOL Guard CVE entry hol.org
• VulDB entry vuldb.com
• Vulnrichment (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:18.