Internal image disclosure via favicon DNS rebinding

SSRF in AliasVault's favicon API before 0.30.3 allows remote authenticated users to retrieve internal images via DNS rebinding. FaviconExtractor.cs validates a hostname's public address but lets the HTTP client resolve it again instead of connecting to the validated address. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an account, attacker-controlled authoritative DNS, and a resolver permitting rebinding; requests remain limited to ports 80 and 443, returning valid images as Base64 or limited timing and error information.