Authenticated SSRF in CRMEB via /adminapi/file/online_upload

Executive Summary

This is an authenticated Server-Side Request Forgery (SSRF) vulnerability in CRMEB v6.0.0. It exists in the /adminapi/file/online_upload endpoint where an authenticated admin can submit a URL in the images array. The server processes this URL using functions like readfile() or cURL, potentially fetching content from attacker-controlled destinations.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unusual outbound requests from the CRMEB server, especially POST requests to /adminapi/file/online_upload. Check server logs for requests containing external or internal IP addresses in the images array. Use tools like tcpdump or Wireshark to capture outbound HTTP/HTTPS traffic from the server.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could force the server to make HTTP requests to internal or external services. This enables network reconnaissance or exposure of internal services, potentially leading to data breaches or further attacks on internal infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. It may result in non-compliance due to potential data exposure or unauthorized system access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the /adminapi/file/online_upload endpoint to trusted users only. Implement strict allowlisting for URLs in the images array, blocking private and loopback addresses. Disable unsafe redirects and validate downloaded content independently of the URL. Update CRMEB to the latest patched version if available.

Useful 0 Not Useful 0