Server-Side Request Forgery in FeelCRM OS

Executive Summary

This is a blind Server-Side Request Forgery (SSRF) vulnerability in feelcrm-os 1.0.0. It affects the getCurlData endpoint in the GoogleController.class.php file. The vulnerability occurs because the endpoint accepts a user-controlled 'url' parameter and passes it directly to PHP's cURL function without validation. This allows attackers to force the server to make HTTP requests to arbitrary internal or external destinations.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for outbound requests originating from the server hosting feelcrm-os 1.0.0, particularly to unusual or internal IP addresses. Check server logs for requests to the /Index/Google/getCurlData endpoint with arbitrary URLs. Use tools like curl to test the endpoint manually: curl -v 'http://<target>/Index/Google/getCurlData?url=http://internal-service' to see if the server attempts to connect to unexpected destinations.

Inspect PHP error logs for cURL-related errors when making requests to the vulnerable endpoint. Network-level detection can involve monitoring egress traffic from the server to identify unauthorized outbound connections.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to make the server connect to internal services, potentially discovering internal network structure or triggering actions in other services. While the SSRF is blind (no direct response access), it could enable internal service discovery or state-changing actions if accessible services exist. The impact depends on what internal services the server can access.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized server-side requests to internal systems. For GDPR, it may lead to unauthorized access to personal data processing systems. For HIPAA, it could allow access to protected health information systems. The lack of input validation and blind SSRF nature makes it harder to detect but still poses risks to data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /Index/Google/getCurlData endpoint by implementing authentication and authorization checks. Update the application to validate and sanitize the 'url' parameter, allowing only specific, trusted domains or IP ranges. Disable cURL functions for user-controlled inputs or implement strict allowlists for URL schemes (e.g., only http/https).

Apply network-level controls to block outbound requests from the server to internal or sensitive IP ranges. Consider upgrading to a patched version if available or applying vendor-supplied fixes. Monitor for unusual network activity as a secondary defense measure.

Useful 0 Not Useful 0