Description
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zammad | Zammad | 6.4 – < 6.4.2 | 6.4.2 |
Advisories 1
- WID-SEC-2025-0684 Zammad: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 6, 2025