Description
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| suitenumerique | docs | ≤ 5.6.1 | — |
References
- GitHub Issue #2545 issue-tracking
- https://github.com/suitenumerique/docs product
- core/api/viewsets.py at v5.6.1 technical-description
- core/models.py at v5.6.1 technical-description
- VulnCheck Advisory: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint third-party-advisory