Executive Summary

CVE-2026-5618 is a vulnerability in Kodbox (KodExplorer) version 1.64 affecting the shareMake/shareCheck component. It allows unauthenticated remote attackers to manipulate share configurations by forging authentication tokens due to a hard-coded symmetric key used in a weak cryptographic scheme. This flaw enables attackers to create or modify external shares, including assigning high-privilege permissions, without proper authorization.

Additionally, attacker-controlled parameters siteFrom and siteTo can be exploited to perform server-side request forgery (SSRF), potentially allowing attackers to make unauthorized requests from the server.

The root causes include the use of a publicly known hard-coded key, reliance on deprecated cryptography without proper session binding or replay protection, and lack of server-side authorization checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized creation and modification of share configurations in Kodbox, potentially granting attackers high-level access such as admin privileges.

It also enables server-side request forgery (SSRF) attacks, which can be used to access internal resources or services that are otherwise protected.

Overall, it compromises the integrity and confidentiality of the Kodbox deployment by bypassing authentication and authorization mechanisms.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and analyzing HTTP requests to the shareOut endpoints, specifically shareMake and shareCheck, for suspicious or forged _check tokens.

Since the exploit involves crafted HTTP GET requests with forged _check tokens that allow unauthorized share modifications, detection can focus on identifying such unauthorized requests.

Suggested commands include using network traffic analysis tools like tcpdump or Wireshark to capture HTTP requests targeting the shareMake/shareCheck endpoints, and searching for requests containing the _check parameter.

• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'shareMake\|shareCheck\|_check='
• Use web server logs (e.g., Apache or Nginx access logs) to search for GET requests to /explorer/shareOut/shareMake or /explorer/shareOut/shareCheck containing the _check parameter.
• grep '_check=' /var/log/nginx/access.log | grep 'shareMake\|shareCheck'

Additionally, implement logging and monitoring of all shareOut-related endpoint calls to detect suspicious activity as part of ongoing detection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing proper authentication and authorization on the shareOut endpoints to restrict operations to authenticated users with appropriate permissions.

Remove the hard-coded symmetric key "kodShareOut" from the codebase and replace it with a per-deployment, high-entropy secret stored securely outside the code.

Replace the custom Mcrypt-based cryptographic scheme with modern cryptographic primitives such as AEAD (AES-GCM, ChaCha20-Poly1305) or HMAC (HMAC-SHA256) over canonicalized parameters.

Bind tokens to context, include timestamps, expirations, and nonces to prevent replay attacks.

Restrict and validate the siteFrom and siteTo parameters to prevent SSRF attacks by allowlisting domains, blocking internal IP ranges and metadata endpoints, and limiting protocols.

Implement logging and monitoring of all shareOut-related endpoint calls to detect suspicious activity.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-5618 allows unauthenticated remote attackers to bypass authentication and authorization mechanisms in Kodbox 1.64, enabling unauthorized creation and modification of share configurations and potential server-side request forgery (SSRF) attacks.

Such unauthorized access and manipulation can lead to breaches of confidentiality and integrity of sensitive data, which may violate common compliance standards and regulations like GDPR and HIPAA that require strict access controls, data protection, and monitoring.

The vulnerability’s impact on authentication and authorization controls, as well as the potential exposure of sensitive information through SSRF, could result in non-compliance with these regulations, especially regarding data privacy, secure access, and incident detection.

Useful 0 Not Useful 0