CVE-2026-102091 in Secure Data Forms
Summary
by MITRE • 10/01/2026
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Kiteworks Secure Data Forms prior to version 9.5.0 represents a critical Server-Side Request Forgery (SSRF) flaw that compromises the integrity of outbound network operations initiated by the application server. This security defect allows an unauthenticated, remote attacker to manipulate the server into issuing arbitrary HTTP or other protocol-based requests to destinations controlled by the adversary or selected from internal network segments. By exploiting this weakness, attackers can bypass standard authentication and authorization mechanisms because the malicious requests originate from a trusted source within the organization's infrastructure, effectively leveraging the server's own permissions and network access privileges to probe restricted environments.
From a technical perspective, the flaw likely stems insufficient validation of user-supplied input used in constructing outbound URLs or request parameters. When the application processes data submitted through its secure forms interface, it fails to adequately sanitize or restrict the destination addresses specified by the client. This lack of rigorous input validation enables an attacker to inject internal IP addresses, localhost references, or metadata service endpoints into form fields that are subsequently processed as part of server-side operations. The server then acts as a proxy for these requests, fetching content from targets that would otherwise be inaccessible directly due to firewall rules, network segmentation, or access control lists designed to protect sensitive internal resources such as database servers, administrative consoles, or cloud metadata services like AWS EC2 instance metadata endpoints.
The operational impact of this vulnerability is severe, particularly in enterprise environments where Kiteworks serves as a central hub for secure file sharing and data exchange. An attacker can utilize the SSRF capability to map out the internal network topology by probing various ports and services on private IP ranges. More critically, if the server has access to sensitive backend systems or cloud metadata endpoints, the attacker may extract confidential information such as authentication tokens, API keys, or configuration details embedded in HTTP responses. This data can then be leveraged for further lateral movement within the network, leading to potential full system compromise of internal assets that rely on trust relationships with the Kiteworks platform.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery as a weakness where web applications retrieve specified resources without validating user-supplied URLs. In terms of offensive security tactics, this exploit maps to MITRE ATT&CK technique T1571, specifically the component related to non-standard ports or protocols used for command and control or data exfiltration via server-side requests. The ability to reach internal-only services also touches upon T1046, Network Service Discovery, as attackers can enumerate active hosts and open ports within the protected network perimeter by analyzing response times and error messages returned from the forged requests.
To mitigate this risk, organizations running versions of Kiteworks Secure Data Forms earlier than 9.5.0 must apply the vendor-provided patch immediately to address the underlying input validation deficiencies. In addition to upgrading software, administrators should implement strict egress filtering policies on network firewalls and proxy servers to restrict outbound connections from application servers to only those destinations explicitly required for business operations. This includes blocking access to private IP ranges such as 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x unless absolutely necessary. Furthermore, deploying Web Application Firewalls with SSRF detection capabilities can provide an additional layer of defense by inspecting outbound traffic for suspicious patterns or unauthorized destination addresses. Regular security audits and penetration testing should also be conducted to identify similar input handling flaws across other components of the application suite.