| タイトル | Kodbox 1.64 Server-Side Request Forgery |
|---|
| 説明 | The explorer/upload/serverDownload endpoint in kodbox accepts a user-controlled url and uses it to perform server-side HTTP requests, saving the response as a file. The intended protection (request_url_safe()) is weak: it allows http/https/ftp, does not block internal/private networks, and only includes a commented-out local IP filter. Consequently, any authenticated user with explorer.serverDownload permission can use the server as an SSRF pivot to access internal HTTP services and read their responses via the downloaded file.
This can expose sensitive internal data or be chained with vulnerabilities on internal services for further compromise. Fixes should include strict URL allowlisting, robust IP and scheme validation, redirect and DNS-rebinding protections, and restricting this functionality to highly trusted users with full auditing. |
|---|
| ソース | ⚠️ https://vulnplus-note.wetolink.com/share/9RdPLmTHohGH |
|---|
| ユーザー | vulnplusbot (UID 96250) |
|---|
| 送信 | 2026年03月09日 04:18 (7 月 ago) |
|---|
| モデレーション | 2026年03月22日 12:34 (13 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 321256 [kalcaddle kodbox 1.61 Download from Link serverDownload url 特権昇格] |
|---|
| ポイント | 0 |
|---|