1Panel CordysCRM Server-Side Request Forgery Vulnerability in TokenService

A server-side request forgery (SSRF) vulnerability has been identified in 1Panel CordysCRM versions through 1.4.1. The issue arises in the TokenService component, specifically within the handling of the mkAddress parameter. This vulnerability allows remote attackers to manipulate the mkAddress argument, causing the server to make unintended HTTP requests to external or internal addresses. The lack of proper validation or sanitization of the mkAddress parameter creates a risk of internal network reconnaissance, data leakage, or further attacks.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where the server is tricked into making requests on behalf of the attacker. This can be used to access internal services, potentially leading to unauthorized data access or manipulation.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/organization/settings/third-party/edit' or '/organization/settings/third-party/test' endpoints with a crafted mkAddress parameter. The server will then make a request to the address specified in mkAddress, demonstrating the SSRF vulnerability.

Remediation

Users are advised to update to a version of CordysCRM that addresses this vulnerability. Additionally, implement whitelist validation for URL parameters, block internal IP ranges, restrict protocols to HTTP/HTTPS, and sanitize user-controlled URL inputs.