CVE-2026-112288
CVE-2026-112288 · Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
CVSS 2.1 · Baja · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
laravel-crm
- Versiones
- ≥ 2.2.5, < 2.2.7: Afectada (semver)
Actualiza a 2.2.7
Fuentes originales
- https://github.com/krayin/laravel-crm/pull/2683
- https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.7
- https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding
- https://nvd.nist.gov/vuln/detail/CVE-2026-112288