CVE-2026-112254 in clientst0r
Summary
by MITRE • 10/19/2026
A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within agit8or1 clientst0r versions up to 3.17.586 represents a critical server-side request forgery flaw located specifically within the Property URL Importer component. This security defect resides in the _fetch_html function found in the file locations/services/property_url_importer.py. The core technical issue stems from insufficient validation of user-supplied input, particularly when handling the url argument passed to this function. Because the application processes these URLs without adequate sanitization or restriction on allowed protocols and destinations, an attacker can manipulate the input to force the server into making HTTP requests to arbitrary internal or external resources. This behavior is characteristic of CWE-918, which defines Server-Side Request Forgery as a vulnerability where a web application fetches a remote resource without validating the user-supplied URL, potentially allowing attackers to bypass access controls and interact with back-end systems that are otherwise protected by firewalls or authentication mechanisms.
The operational impact of this flaw is significant due to its potential for remote exploitation. Since the attack can be launched remotely over the network, an unauthenticated attacker could theoretically leverage this vulnerability to probe internal networks, exfiltrate sensitive data from local services, or perform SSRF-based attacks against other components within the same infrastructure. The fact that a public exploit exists further elevates the risk profile, as it lowers the barrier for entry significantly, allowing less sophisticated threat actors to execute successful attacks without needing to develop custom tooling. This aligns with specific tactics in the MITRE ATT&CK framework, particularly those related to Discovery and Collection phases where adversaries use SSRF to map internal network topologies or access cloud metadata services that often contain credentials and configuration details.
Mitigation for this vulnerability requires immediate action by upgrading the affected software to version 3.17.587 or later. The vendor has acknowledged the issue professionally and released a patch identified as commit hash 7e75c6cc6a07621c10be9b07fafd99e89a02e327, which addresses the input validation logic within the _fetch_html function. Until the upgrade is performed, organizations should consider implementing network-level controls such as web application firewalls or proxy rules that restrict outbound connections from the affected server to only known and trusted destinations. Additionally, disabling unnecessary HTTP methods and ensuring strict allow-listing of permitted URL schemes can provide a layer of defense in depth while the patch is being deployed. Given the public availability of exploits, prioritizing this remediation is essential to prevent potential compromise of the underlying infrastructure.