1Panel CordysCRM Server-Side Request Forgery Vulnerability in Integration Configuration Service

A server-side request forgery (SSRF) vulnerability exists in 1Panel CordysCRM versions through 1.4.1. The issue is located in the IntegrationConfigService.java file, specifically within the getSqlBotSrc function. The vulnerability arises because the application improperly validates the appSecret parameter, allowing remote attackers to manipulate it and cause the server to make unauthorized requests to external or internal resources.

Impact

Exploitation of this vulnerability allows for internal network reconnaissance, data leakage, or further attacks on internal services.

Reproduction

To reproduce this vulnerability, send a POST request to the '/organization/settings/third-party/edit' or '/organization/settings/third-party/test' endpoints with an 'appSecret' parameter that includes a crafted URL, such as 'src="http://<your-dns-log-domain>"'. The server will then make a request to the injected URL, which can be verified by checking for a DNS callback.

Remediation

Users are advised to implement whitelist validation for URLs, block internal IP ranges, restrict protocols to only allow HTTP and HTTPS, and sanitize all extracted URLs before making requests.