TwoNav Link Identification Function Sensitive Information Disclosure Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in TwoNav version 2.1.18-20241105. This vulnerability allows remote attackers to access sensitive information through the link identification function. The issue arises because the application can be tricked into sending requests to internal resources, such as localhost.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information by allowing attackers to send requests to internal services or resources.

Reproduction

The vulnerability can be reproduced by using a tool like Burp Suite to intercept and modify requests sent to the link identification function. By directing the request to '127.0.0.1', the Burp Suite collaborator can receive the request, demonstrating the SSRF vulnerability.