BaseFortify

Executive Summary

This vulnerability involves the Malcolm file-upload component using an upstream FilePond PHP server with minimal modifications. The index.php file exposes an API route that uses curl to download arbitrary URLs, including following redirects. For HEAD requests, it stores the fetched response body in a transfer directory and returns a transfer ID, allowing full readback of the fetched content.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in Malcolm's file-upload component, check for the presence of the exposed fetch API route in index.php. Inspect the Docker container for the FilePond PHP server files, particularly index.php, and verify if the fetch route exists. Look for unexpected network connections from the upload container to internal services or arbitrary URLs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive files or data from internal systems by tricking the server into fetching and exposing their contents. This could lead to unauthorized access to confidential information, data breaches, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to the FilePond PHP server's fetch API route that allows arbitrary URL downloads. Update Malcolm to a patched version if available. Monitor network traffic for unusual outbound connections from the upload container.

Useful 0 Not Useful 0