CVE-2023-46736 Server-Side Request Forgery in espocrm

Medium 5.3 Published 5 Dec 2023 Updated 2 Aug 2024

Attackers with access to the image upload endpoint can exploit SSRF to disclose internal information and bypass firewalls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46736?

CVE-2023-46736 is a medium-severity server-side request forgery vulnerability in espocrm, published on 5 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-918

Which versions are affected by CVE-2023-46736?

1 open source package ship an affected version, including espocrm. It affects 1 product.

Package	Affected	Fixed in
`espocrm` Bitnami	All versions	`8.0.2`

Products include Espocrm Espocrm.

How do I fix CVE-2023-46736?

Upgrade espocrm to 8.0.2 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-46736 being exploited?

There is no known exploitation of CVE-2023-46736 in the wild and no public exploit code.

Sources

Also known as BIT-espocrm-2023-46736, GHSA-g955-rwxx-jvf6.