Asesidaa

يمكن للمستخدمين الذين يتمتعون بأذونات webhook تنفيذ هجوم تزوير الطلبات من جانب الخادم (SSRF) عبر webhooks. وفي حال كان لديهم صلاحية عرض سجلات الويب هوك، فإن الرد الجزئي على الطلب يُكشف أيضًا. وهذا يسمح بتجاوز جدران الحماية للتفاعل مع الخدمات الداخلية.

The issue is related to a Server-Side Request Forgery (SSRF) vulnerability via the upload image from URL API. Users with access to the `/Attachment/fromImageUrl` endpoint can specify a URL to point to an internal host. Although there is a check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information, target internal hosts, and bypass firewalls.

The issue is related to a full Server-Side Request Forgery (SSRF) vulnerability in the "/api/upload.php" endpoint. This endpoint does not filter URLs, allowing a malicious user to cause the server to make resource requests to untrusted domains. Protocols like "file://" can also be used to access the server disk. The request result can then be retrieved using "/api/download.php".

The issue is related to server-side request forgery. In the Network module, a manufacturer account can use the "/api/updateProducts.json" endpoint to make the server send a request to an arbitrary host, allowing the server to be used as a proxy into the internal network. Additionally, there is a time of check time of use issue due to inadequate checks on valid images. This can be exploited by using a custom server that returns 200 on HEAD requests, then returns a valid image on the first GET request, and then a 302 redirect to the final target on the second GET request, making it a full SSRF.