mdisec

SSRF & Credential Leakage via Fal.ai Media Status Polling

Severity: High Type: SSRF / Credential Leakage Date: 2026-03-24 Status: Confirmed (reproduced with Burp Collaborator) CVSS 3.1: 8.6 (High)

---

mdisec

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

mdisec

alert(1)

mdisec

Keybase proof

I hereby claim:

• I am mmetince on github.
• I am mehmet (https://keybase.io/mehmet) on keybase.
• I have a public key ASCYw3yOgrkGgAPBBbyrV6HKGtNys38L1oxJ8Ucg5Pj26wo

To claim this, I am signing this object:

mdisec

{
  "title": "ALERTS",
  "services": {
    "query": {
      "idQueue": [],
      "list": {
        "3": {
          "id": 3,
          "color": "#BF1B00",
          "query": "event_type:\"alert\"",

mdisec

# Nginx proxy for Elasticsearch + Kibana
#
# In this setup, we are password protecting the saving of dashboards. You may
# wish to extend the password protection to all paths.
#
# Even though these paths are being called as the result of an ajax request, the
# browser will prompt for a username/password on the first request
#
# If you use this, you'll want to point config.js at http://FQDN:443/ instead of
# http://FQDN:9200