CVE-2023-25262 Server-side request forgery in n/a
An attacker can exploit SSRF in Stimulsoft Designer to exfiltrate data from internal network machines via server-side requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25262?
CVE-2023-25262 is a high-severity server-side request forgery vulnerability in n/a, published on 28 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
Weakness: CWE-918
Which versions are affected by CVE-2023-25262?
It affects 1 product.
Products include Stimulsoft Designer.
How do I fix CVE-2023-25262?
No fix has been published for CVE-2023-25262 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-25262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25262 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f289-g9w2-9j5h.