Blind SSRF on the RSS Feed in glpi-project/glpi

Valid

Reported on Jul 18th 2022

A normal user can add an RSS Feed with an internal URL which could lead to a blind SSRF issue by using local URLs.

Impact

Since this is a blind SSRF, it is not possible to read the response of HTTP requests. However, this vulnerability can be used for reconnaissance or it can be used to craft server requests.

Proof Of Concept

• Run an internal http server on port X
• Put an internal URL such as "gopher://127.0.0.1:X"
• Save the RSS Feed Item
• Check the Content tab

CVE

CVE-2022-36112 published

Vulnerability Type

CWE-918: Server-Side Request Forgery (SSRF)

Severity

Low

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Open in visual CVSS calculator

Registry

Other

Affected Version

9.5.6

Visibility

Public

Status

Fixed

Found by

Seif-Allah Homrani @seifallahhomrani1

LIGHTWEIGHT