CyberRota Analysis
AI-GeneratedEmlog Pro versions up to 2.6.23 have a critical vulnerability that disables TLS certificate validation, allowing network-adjacent attackers to intercept and manipulate outbound HTTPS requests to LLM providers. This flaw enables attackers to extract sensitive Authorization Bearer API keys and inject malicious AI responses, potentially compromising the integrity of the application. Organizations using Emlog Pro should prioritize patching this vulnerability to mitigate the risk of man-in-the-middle attacks and unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.