Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP
### Impact
The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.
This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.
### Patches
The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.
This patch has
### Impact
InvenTree uses [EasyMDE](https://github.com/Ionaru/easy-markdown-editor) for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).
By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.
*Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users*
### Solution
The solution here is two-fold:
- Enable data sanitization for the EasyMDE renderer - [#3205](https://github.com/inventree/InvenTree
### Impact
Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection
### Patches
- The issue is addressed in the upcoming 0.8.0 release
- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release
### Workarounds
Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).
### References
- https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
- https://owasp.org/www-community/attacks/CSV_Injection
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github](
### Impact
Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.
The problem here stems from multiple issues:
- Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
- Lack of HTML escaping when rendering data on the front end
The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree