CVE-2026-112237 in Kitodo.Presentation Extension
Summary
by MITRE • 10/20/2026
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described constitutes a critical insecure direct object reference flaw within an extension's public proxy endpoint functionality. This specific component is designed to fetch URLs on behalf of visitors, acting as an intermediary between the client and external or internal resources. The core technical deficiency lies in the inconsistent application of authorization controls across different HTTP request methods handled by this endpoint. While most methods are protected by robust authentication mechanisms that verify user privileges before processing a request, one specific method bypasses these checks entirely. This inconsistency creates a significant security gap where an unauthenticated attacker can exploit the unprotected method to dictate the target URL with complete freedom. By controlling the destination address, the attacker effectively turns the server into an open proxy or a pivot point for network reconnaissance activities against both internal infrastructure and external targets that are accessible from the server's network environment.
From an operational impact perspective, this vulnerability enables unauthorized network probing and potential data exfiltration through side-channel information leakage. Although the response body is not disclosed to the attacker, preventing direct theft of sensitive content retrieved by the proxy, the availability of HTTP status codes and selected response headers provides sufficient intelligence for sophisticated attacks. An attacker can utilize these responses to perform port scanning, service fingerprinting, and internal network mapping within a protected environment that would otherwise be inaccessible from the public internet. For instance, variations in timing or specific header values might reveal whether a target host is alive, what services are running on specific ports, or even trigger unintended actions on vulnerable backend systems if they process requests differently based on headers. This capability significantly expands the attack surface of the organization's internal network, potentially leading to further compromise through subsequent exploitation steps that rely on accurate reconnaissance data.
In terms of industry standards and threat modeling, this vulnerability aligns with CWE-284 Improper Access Control, specifically regarding inconsistent enforcement of access controls across different operations within a single interface. It also relates closely to CWE-918 Server-Side Request Forgery (SSRF), as the application allows an unauthenticated user to initiate HTTP requests on their behalf to arbitrary destinations. Within the MITRE ATT&CK framework, this behavior facilitates Reconnaissance techniques such as Network Service Scanning and Internal Network Discovery. The ability to probe internal hosts effectively grants the attacker valuable situational awareness of the network topology, which is often a precursor to lateral movement or deeper penetration into critical systems.
To mitigate this vulnerability, immediate remediation should focus on enforcing consistent authorization checks across all HTTP methods supported by the proxy endpoint. Developers must audit the codebase to ensure that every entry point requiring sensitive operations validates user credentials and permissions before processing any request parameters. Additionally, implementing strict input validation for URL targets is essential; this includes whitelisting allowed domains or IP ranges rather than relying solely on authentication checks. If internal network access via the proxy is not strictly required for business functions, it should be disabled entirely. For scenarios where such functionality is necessary, deploying a Web Application Firewall with rules to detect and block SSRF patterns can provide an additional layer of defense. Regular security testing, including automated scans for inconsistent authorization logic and manual penetration tests focusing on endpoint method variations, will help identify similar flaws in other parts of the application architecture before they can be exploited by malicious actors.