DevExpress Server-Side Request Forgery Vulnerability via AsyncDownloader

A server-side request forgery (SSRF) vulnerability has been identified in DevExpress products prior to version 23.1.3. This vulnerability allows the AsyncDownloader component to make unauthorized requests, potentially leading to exposure of internal services or resources.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can manipulate the server to make requests on its behalf, potentially accessing internal resources or services that are not exposed to the public.

Reproduction

The vulnerability can be reproduced by using a version of DevExpress prior to 23.1.3 that includes the AsyncDownloader component. Once the application is running, the AsyncDownloader can be configured to make requests to internal services, bypassing normal access controls.

Remediation

Users are advised to update to DevExpress version 23.1.3 or later, where this vulnerability has been addressed.