Guardsix ODBC Enrichment Plugins Logic Flaw Leading to SSRF Vulnerability

A logic flaw in Guardsix ODBC Enrichment Plugins, prior to version 5.2.1, allowed stored database credentials to be improperly reused when editing an existing Enrichment Source. Although connection parameters such as Host, IP address, or Port were changed, the old credentials remained, creating a vulnerability. This flaw enabled an authenticated Operator user to redirect database connections to unintended internal systems, potentially misusing valid stored credentials.

Impact

Exploitation of this vulnerability could lead to Server-Side Request Forgery (SSRF), allowing an attacker to manipulate server requests and potentially access internal systems or services.

Remediation

Users are advised to upgrade to Guardsix Logpoint version 7.9.0 and ODBC version 5.2.1.