PT-2023-30172 · Unknown · Foodcoopshop
Asesidaa
·
Published
2023-11-02
·
Updated
2023-11-09
·
CVE-2023-46725
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
FoodCoopShop versions prior to 3.6.1
Description
The issue is related to server-side request forgery. In the Network module, a manufacturer account can use the "/api/updateProducts.json" endpoint to make the server send a request to an arbitrary host, allowing the server to be used as a proxy into the internal network. Additionally, there is a time of check time of use issue due to inadequate checks on valid images. This can be exploited by using a custom server that returns 200 on HEAD requests, then returns a valid image on the first GET request, and then a 302 redirect to the final target on the second GET request, making it a full SSRF.
Recommendations
For versions prior to 3.6.1, update to version 3.6.1 to fix the vulnerability.
As a temporary workaround, consider restricting access to the "/api/updateProducts.json" endpoint in the Network module to minimize the risk of exploitation.
Avoid using the
data[data][0][image] parameter in the affected API endpoint until the issue is resolved.Exploit
Fix
Time Of Check To Time Of Use
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Foodcoopshop