CVE-2023-41054

CVE-2023-41054 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting LibreY, a privacy-respecting meta search engine, specifically in its image_proxy.php file before commit 8f9b9803f231e2954e5b49987a532d28fe50a627. This flaw allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary internal or external targets. With a CVSS score of 9.1 (CRITICAL), the vulnerability has a low attack complexity and requires no user interaction or privileges, enabling attackers to retrieve sensitive internal network information or launch Denial-of-Service (DoS) attacks. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.