| Название | Kodbox 1.64 Server-Side Request Forgery |
|---|
| Описание | The explorer/upload/serverDownload endpoint in kodbox accepts a user-controlled url and uses it to perform server-side HTTP requests, saving the response as a file. The intended protection (request_url_safe()) is weak: it allows http/https/ftp, does not block internal/private networks, and only includes a commented-out local IP filter. Consequently, any authenticated user with explorer.serverDownload permission can use the server as an SSRF pivot to access internal HTTP services and read their responses via the downloaded file.
This can expose sensitive internal data or be chained with vulnerabilities on internal services for further compromise. Fixes should include strict URL allowlisting, robust IP and scheme validation, redirect and DNS-rebinding protections, and restricting this functionality to highly trusted users with full auditing. |
|---|
| Источник | ⚠️ https://vulnplus-note.wetolink.com/share/9RdPLmTHohGH |
|---|
| Пользователь | vulnplusbot (UID 96250) |
|---|
| Представление | 09.03.2026 04:18 (7 месяцы назад) |
|---|
| Модерация | 22.03.2026 12:34 (13 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 321256 [kalcaddle kodbox 1.61 Download from Link serverDownload url эскалация привилегий] |
|---|
| Баллы | 0 |
|---|