Description
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
suitenumerique docs
Default version status: unaffected
0 to ≤ 5.6.1affected
References
- https://github.com/suitenumerique/docs/issues/2545 ↗
- https://github.com/suitenumerique/docs ↗
- https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py ↗
- https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py ↗
- https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint ↗