Listen to this Post
The vulnerability exists in the `/proxy` endpoint of Mailpit. This endpoint is designed to fetch external resources but improperly validates target addresses. While it checks that the URL scheme is `http://` or `https://`, it fails to enforce restrictions on destination IP addresses. Specifically, it does not block requests to internal, private, or loopback IP ranges defined in RFC 1918 and RFC 5735. An attacker can craft a request with a URL parameter pointing to `127.0.0.1` or another internal service. The application server, acting on behalf of the attacker, will then forward the HTTP GET request to that internal resource. This allows the attacker to bypass network security controls and interact with systems behind the firewall that are otherwise inaccessible, leading to information disclosure, network scanning, and potential access to cloud instance metadata services.
Platform: Mailpit
Version: All versions
Vulnerability : SSRF
Severity: Medium
date: 2024-10-10
Prediction: 2024-11-15
What Undercode Say:
curl -s "http://target:8025/proxy?url=http://127.0.0.1:8025/api/v1/messages"
curl "http://target:8025/proxy?url=http://169.254.169.254/latest/meta-data/"
How Exploit:
1. Attacker identifies exposed Mailpit instance.
- Crafts request to `/proxy` endpoint with internal IP.
3. Server fetches data from internal API/metadata service.
4. Attacker reads sensitive response data.
Protection from this CVE
- Implement strict IP allow/deny lists.
- Disable unused `/proxy` endpoint.
- Enforce authentication before proxying.
- Use network segmentation.
Impact:
Internal network scanning.
Sensitive data disclosure.
Cloud metadata exposure.
Lateral movement facilitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
