{"id":"CVE-2021-25939","details":"In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.","modified":"2026-07-09T01:30:21.669791Z","published":"2022-02-09T13:15:08.447Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:arangodb:arangodb:3.9.0:alpha1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.9.0-alpha1"},{"last_affected":"3.9.0-alpha1"}],"source":"CPE_STRING","vendor_product":"arangodb:arangodb"}]},"references":[{"type":"FIX","url":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175"},{"type":"FIX","url":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd"},{"type":"EVIDENCE","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25939"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arangodb/arangodb","events":[{"introduced":"6285548e9a094f517fb28f58192d1d29be0f4f37"},{"last_affected":"1599d1db57279467472219d6b01c1248a685834b"},{"fixed":"d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175"},{"fixed":"d9b7f019d2435f107b19a59190bf9cc27d5f34dd"}],"database_specific":{"cpe":"cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.7.0"},{"last_affected":"3.8.5.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25939.json","vanir_signatures_modified":"2026-07-09T01:30:21Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp","function":"ServerSecurityFeature::collectOptions"},"deprecated":false,"digest":{"function_hash":"174794310772793720377014152124395755500","length":919},"id":"CVE-2021-25939-183e74e1","signature_type":"Function"},{"source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp","function":"ServerSecurityFeature::collectOptions"},"deprecated":false,"digest":{"function_hash":"79457259610168342800655107710465570094","length":908},"id":"CVE-2021-25939-1f9e20c6","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171578474358744883050532284774427090994","145922431644286592950151905473129759862","91279759690882665212308453718633806755","21501310935273928295976518107387063199","295555603563205786738352619570560755768","303631136301426389800023109120272632237","58792356836980467249022217435604909228","151319066332408957033740052497950201960","202526629000751422200092726619576886378"]},"id":"CVE-2021-25939-2ac46c25","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"131924263341042407445514875787121144924","length":1626},"id":"CVE-2021-25939-3fc3f253","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175","target":{"function":"TRI_InitV8ServerUtils","file":"arangod/V8Server/v8-actions.cpp"}},{"deprecated":false,"digest":{"function_hash":"28334326683509858840648989849152962029","length":290},"id":"CVE-2021-25939-66ed81af","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp","function":"ServerSecurityFeature::ServerSecurityFeature"}},{"target":{"file":"arangod/V8Server/v8-actions.cpp","function":"TRI_InitV8ServerUtils"},"deprecated":false,"digest":{"function_hash":"131924263341042407445514875787121144924","length":1626},"id":"CVE-2021-25939-7b577a58","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd"},{"digest":{"function_hash":"28334326683509858840648989849152962029","length":290},"id":"CVE-2021-25939-7c7c3d71","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp","function":"ServerSecurityFeature::ServerSecurityFeature"},"deprecated":false},{"target":{"file":"arangod/GeneralServer/ServerSecurityFeature.h"},"deprecated":false,"digest":{"line_hashes":["45822496179553618684218159847719626242","201135298908289642216005663799829705959","112959675162389496003525350671959605992","90046315187897303660861499032904069623","325486636789127341608538438883649628320","122235553757083154865624481285303866095","92837879858124137096717948175360380905"],"threshold":0.9},"id":"CVE-2021-25939-9f065233","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175"},{"deprecated":false,"digest":{"line_hashes":["45822496179553618684218159847719626242","201135298908289642216005663799829705959","112959675162389496003525350671959605992","90046315187897303660861499032904069623","325486636789127341608538438883649628320","122235553757083154865624481285303866095","92837879858124137096717948175360380905"],"threshold":0.9},"id":"CVE-2021-25939-b7e39d5f","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd","target":{"file":"arangod/GeneralServer/ServerSecurityFeature.h"}},{"deprecated":false,"digest":{"line_hashes":["56459050841252215816821742522104797786","239060332871912129357072040279168801939","21973457217130382295300425987111536420","51017139329089179302438965250338779523","64736567541857265099589241050943001035","71581145802202207131550779210444589178","59325315018335777990084717438678633912"],"threshold":0.9},"id":"CVE-2021-25939-bd9011dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd","target":{"file":"arangod/V8Server/v8-actions.cpp"}},{"target":{"file":"arangod/GeneralServer/ServerSecurityFeature.cpp"},"deprecated":false,"digest":{"line_hashes":["171578474358744883050532284774427090994","145922431644286592950151905473129759862","91279759690882665212308453718633806755","21501310935273928295976518107387063199","295555603563205786738352619570560755768","278761347095708978043631765692452266293","80904735549079215090123115401127728353","69638725692353024319440929426838261029","303631136301426389800023109120272632237","58792356836980467249022217435604909228","151319066332408957033740052497950201960","202526629000751422200092726619576886378"],"threshold":0.9},"id":"CVE-2021-25939-c89aede7","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175","target":{"file":"arangod/V8Server/v8-actions.cpp"},"deprecated":false,"digest":{"line_hashes":["198416778605841137435972778522675237449","44347626381409520970205566983958127120","206321675041124627775802115862911742389","190391448780593587838988850063661580219","220897004022331659164416289636182348350","167586439215528886693894676029754068672","17634606546523581049692261570861640207"],"threshold":0.9},"id":"CVE-2021-25939-fbe0a29a"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}]}