CVE-2026-112288
CVE-2026-112288 · Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
CVSS 2.1 · Niedrig · EPSS 0,2% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
laravel-crm
- Softwareversionen
- ≥ 2.2.5, < 2.2.7: Betroffen (semver)
Auf 2.2.7 aktualisieren
Originalquellen
- https://github.com/krayin/laravel-crm/pull/2683
- https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.7
- https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding
- https://nvd.nist.gov/vuln/detail/CVE-2026-112288