OneNav Server-Side Request Forgery Vulnerability in Custom Headers

A Server-Side Request Forgery (SSRF) vulnerability has been identified in OneNav version 1.1.0. This issue arises in custom headers, allowing potential exploitation by manipulating header values to make unauthorized requests from the server.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, where an attacker can make the server send requests on its behalf. This could be used to access internal services or resources that are not normally exposed to the outside world.

Reproduction

To reproduce this vulnerability, navigate to the site settings page in the OneNav application. Custom footers require a subscription, but custom headers can be added without any restrictions. After saving the settings, return to the index page. This action will trigger a pop-up window indicating an XSS (Cross-Site Scripting) vulnerability, while also sending a request to the intranet, demonstrating the SSRF exploitation.