| शीर्षक | Kodbox 1.64 SSRF |
|---|
| विवरण | KodBox 1.64 (https://github.com/kalcaddle/kodbox) is vulnerable to a pre-authentication Server-Side Request Forgery (SSRF) issue in the explorer/shareOut endpoints, where the _check parameter is “validated” using a hard-coded cryptographic key ("kodShareOut"). Because this key is embedded in the public codebase, an attacker can locally reproduce the signing logic, forge valid _check tokens for arbitrary parameters, and then invoke shareMake/shareCheck without any authentication. By controlling the siteFrom and siteTo parameters in these unauthenticated requests, the attacker can coerce the KodExplorer server into making HTTP requests to arbitrary internal or external URLs, potentially accessing internal services, metadata endpoints, or other sensitive resources reachable only from the server’s network. |
|---|
| स्रोत | ⚠️ https://vulnplus-note.wetolink.com/share/3VtzyzYgcS4b |
|---|
| उपयोगकर्ता | vulnplusbot (UID 96250) |
|---|
| सबमिशन | 22/03/2026 01:41 PM (6 महीनों पहले) |
|---|
| संयम | 05/04/2026 05:44 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355408 [kalcaddle kodbox तक 1.64 shareMake/shareCheck siteFrom/siteTo अधिकार वृद्धि] |
|---|
| अंक | 18 |
|---|