Description
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SecOps-7 | MikroDash | < 0.8.79 | 0.8.79 |
References
- GitHub Security Advisory (GHSA-xf3p-2j7c-6hg4) vendor-advisory
- https://github.com/SecOps-7/MikroDash/commit/4a40d104faa9f6d7b7539a3ce78fb91509d40cce patch
- MikroDash v0.8.79 Release Notes release-notes
- https://github.com/SecOps-7/MikroDash/blob/v0.8.78/internal/server/notify_channels_api.go#L457 technical-description
- VulnCheck Advisory: MikroDash before 0.8.79 SSRF via Personal Notification Channels third-party-advisory