Asesidaa

Users with webhook permissions can conduct Server-Side Request Forgery (SSRF) via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed. This allows bypassing firewalls to interact with internal services.

The issue is related to a Server-Side Request Forgery (SSRF) vulnerability via the upload image from URL API. Users with access to the `/Attachment/fromImageUrl` endpoint can specify a URL to point to an internal host. Although there is a check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information, target internal hosts, and bypass firewalls.

The issue is related to a full Server-Side Request Forgery (SSRF) vulnerability in the "/api/upload.php" endpoint. This endpoint does not filter URLs, allowing a malicious user to cause the server to make resource requests to untrusted domains. Protocols like "file://" can also be used to access the server disk. The request result can then be retrieved using "/api/download.php".

The issue is related to server-side request forgery. In the Network module, a manufacturer account can use the "/api/updateProducts.json" endpoint to make the server send a request to an arbitrary host, allowing the server to be used as a proxy into the internal network. Additionally, there is a time of check time of use issue due to inadequate checks on valid images. This can be exploited by using a custom server that returns 200 on HEAD requests, then returns a valid image on the first GET request, and then a 302 redirect to the final target on the second GET request, making it a full SSRF.