Server-Side Request Forgery in Docs Through 5.6.1

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in Docs through 5.6.1. It exists in the cors-proxy endpoint, where anonymous attackers can make outbound requests by providing a public document UUID. Attackers exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and steal image content.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual outbound requests from the cors-proxy endpoint. Check server logs for requests to the /cors-proxy endpoint with public document UUIDs. Look for DNS time-of-check-time-of-use race conditions or shared address space bypasses in network traffic.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this flaw to access internal systems, exfiltrate sensitive data like images, or interact with internal services. This could lead to unauthorized data access, network reconnaissance, or further attacks on internal infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Docs to version 5.6.2 or later to patch the vulnerability. Disable the cors-proxy endpoint if not required. Implement network segmentation to restrict outbound requests from the server. Monitor for suspicious outbound traffic patterns.

Useful 0 Not Useful 0