Server-Side Request Forgery in Snipe-IT Before 8.7.0

Executive Summary

Snipe-IT before version 8.7.0 has a server-side request forgery (SSRF) vulnerability in its webhook testing feature. This allows super-admin users to probe internal network addresses, including loopback and private IP ranges. Attackers can send webhooks to internal hosts and ports, then analyze error responses (4xx vs 5xx) to identify open ports and active hosts.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability, monitor webhook testing activity in Snipe-IT logs for unusual requests targeting internal IP ranges or loopback addresses. Check for repeated 4xx and 5xx responses from the Test Webhooks endpoint, which may indicate port scanning attempts.

Useful 0 Not Useful 0

Impact Analysis

If you are a super-admin user in Snipe-IT before 8.7.0, an attacker with access could exploit this to map your internal network, discover active hosts, and identify open ports. This could lead to further attacks like unauthorized access or data exfiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by exposing internal network information, potentially leading to unauthorized access to sensitive data. Organizations may fail to meet security controls in GDPR, HIPAA, or other regulations due to insufficient network protection.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Snipe-IT to version 8.7.0 or later to patch the vulnerability.
• Restrict super-admin access to only necessary personnel to limit exploitation potential.
• Monitor and audit webhook testing activities for suspicious behavior targeting internal networks.

Useful 0 Not Useful 0