New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSRF issue #263
Comments
Thanks for the feedback. We have made restrictions in this area before, but there is indeed a need to obtain resources from the intranet. This restriction has been removed in all subsequent versions. https://github.com/kalcaddle/kodbox/blob/main/app/function/web.function.php#L628
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
SSRF issue is found on ?explorer/upload/serverDownload endpoint, app/controller/explorer/upload.class.php. It allows authenticated users to access and download files from any internal IP address and potentially cause lateral movement and data exfiltration. Should consider restricting the download to external IP address only.
The text was updated successfully, but these errors were encountered: