SLiMS 9.6.0 - Server-Side Request Forguery (SSRF) & Local File Inclusion (LFI)

[m3n0sd0n4ld]

Hi,

Excuse me, but I don't see any area where to report security issues, given the history of other users, I will put it here, but it would be highly advisable that you quickly fix the vulnerability and/or put this issues in private format until corrected.

Description
The current version of SLiMS 9.6.0 presents a high/critical vulnerability, since it allows an authenticated user with access to the "scrape_image.php" file to send requests to internal services or load the content of very relevant internal files (system files, configuration files, backup, SSH keys, etc...) over the "imageURL" parameter.

Proof of Concept:
The following illustration shows how the malicious user can manage to load the contents of the "index.html" file of the internal web server on port 80 (port not exposed externally), showing that the attacker would not only manage to find out internal services, but could extract the information in image format encoded in base64.

In addition, this can allow to reach relevant files of the website, in this case it has been used to extract a backup of the site's database.

Finally, the vulnerability has been used to reach an internal file of the machine, this could be used to reach other files where SSH credentials or keys are exposed, gaining illegitimate access to the server and compromising the machine.

Expected behavior
The application should only load files with image format (png, gif, jpg, etc...) and from a specific path of the application, preventing the path to be altered arbitrarily and from the client side.

In addition, it should be prevented from loading to internal paths or external servers not allowed by the application and/or organization, thus preventing it from being possible to identify and reach internal resources or reach malicious external sources to load malicious code.

Best regards,

[drajathasan]

Thanks for your report. Will be fix ASAP.

[m3n0sd0n4ld]

Hi,

From INCIBE, they indicate me the following identifier CVE-2023-3744 reserved for this vulnerability.

Best regards,