PT-2021-10948 · Winmail · Winmail

Ppsoft1990 · Published 2021-01-26 · Updated 2021-02-03 · CVE-2020-23776

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Winmail version 6.5

Description: A Server-Side Request Forgery (SSRF) issue exists in the app.php file, specifically in the key parameter when HTTPS is enabled. This allows an attacker to manipulate the server into sending a request to a specific URL. Furthermore, an attacker can modify the HOST value in the request header to control where the server sends the request.

Recommendations: For Winmail version 6.5, as a temporary workaround, consider restricting access to the app.php file or disabling the key parameter when HTTPS is on until a patch is available. Additionally, restrict modifications to the HOST header value to prevent unauthorized requests.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-23776

Affected Products

Winmail

References · 4

• 🔥 https://github.com/zhonghaozhao/winmail/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23776 · Security Note
• https://t.me/cibsecurity/22687 · Telegram Post