Kiteworks Server-Side Request Forgery Vulnerability via DNS Rebinding
Vulnerability
A server-side request forgery (SSRF) vulnerability has been identified in Kiteworks Core versions prior to 9.2.0. This vulnerability arises from a flaw in the application's configuration functionality, which allows malicious administrators to bypass existing SSRF protections through DNS rebinding attacks. Exploitation of this vulnerability could enable access to internal services that are meant to be restricted.
Impact
Exploitation of this vulnerability could lead to unauthorized access to internal services, bypassing intended restrictions.
Remediation
Users are advised to upgrade Kiteworks to version 9.2.0 or later.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.