CVE-2026-33534— EspoCRM 代码问题漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-33534 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
服务端请求伪造(SSRF)
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
EspoCRM 代码问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
EspoCRM是EspoCRM开源的一套开源的基于Web的客户关系管理系统（CRM）。该系统提供销售自动化、社区和客户支持等功能。 EspoCRM 9.3.3及之前版本存在代码问题漏洞，该漏洞源于HostCheck::isNotInternalHost函数依赖的PHP filter_var函数无法识别替代IPv4表示法，可能导致服务端请求伪造攻击。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-33534 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | EspoCRM <= 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost(), letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33534.yaml | POC详情 |
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-33534 的情报信息
请登录查看更多情报信息。
CVE-2026-33534 厂商安全公告 (1)
同批安全公告 · espocrm · 2026-04-13 · 共 4 条
| CVE-2026-33740 | 5.4 MEDIUM | EspoCRM 安全漏洞 |
| CVE-2026-33657 | 4.6 MEDIUM | EspoCRM 安全漏洞 |
| CVE-2026-33659 | 3.5 LOW | EspoCRM 代码问题漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-33534
暂无评论