Snipe-IT Markdown Image Injection Leading to File Read

Executive Summary

This vulnerability affects Snipe-IT versions before 8.7.0. It allows authenticated users to exploit improperly sanitized markdown image syntax in note fields to read arbitrary server files and perform server-side HTTP requests. The markdown image tags bypass HTML escaping and are processed by the CommonMark parser, which laravel-mail-auto-embed resolves using functions like file_get_contents or curl.

Useful 0 Not Useful 0

Detection Guidance

• Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php or check the admin panel version display.
• Review note fields in checkout acceptance for markdown image syntax like  or .
• Inspect outbound emails for embedded file contents or unexpected URLs from laravel-mail-auto-embed processing.
• Monitor server logs for unusual file_get_contents or curl requests targeting sensitive files.

Useful 0 Not Useful 0

Impact Analysis

Attackers can read sensitive files such as .env containing the APP_KEY, exfiltrate data, and issue server-side requests. This could lead to unauthorized access, data breaches, or further compromise of the system if exploited by authenticated users with pending checkout acceptance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Snipe-IT to version 8.7.0 or later immediately to patch the vulnerability.
• Disable markdown image syntax in note fields by applying the CommonMark extension update.
• Audit all note fields and emails for signs of exploitation, especially .env file exfiltration.
• Restrict file access permissions and review APP_KEY exposure if .env files were accessed.

Useful 0 Not Useful 0