CyberRota Analysis
AI-GeneratedEspoCRM versions prior to 10.0.4 are susceptible to server-side request forgery due to inadequate validation of outbound URLs, allowing attackers to exploit IPv6 transition addresses to access internal network services. This vulnerability can be exploited by authenticated users with attachment access and by admin or API users during outbound webhook delivery, potentially compromising sensitive internal resources. Organizations using EspoCRM should prioritize patching this vulnerability to mitigate the risk of unauthorized access to their internal systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.