Topic

#SSRF

2 articles

critical2 sourcesCVE-2026-102255 CVE-2026-102256 +6

SonicWall Issues Emergency Hotfixes for Maximum-Severity Pre-Auth SSRF in SMA1000 Gateways

SonicWall has rolled out emergency hotfixes to resolve four distinct security flaws targeting its enterprise-grade Secure Mobile Access (SMA) 1000 series products. Leading the advisory is CVE-2026-102255, a maximum-severity, pre-authentication server-side request forgery (SSRF) flaw residing directly inside the Appliance WorkPlace interface. The issue stems from an unintended alternate access-path weakness that enables unauthenticated attackers to execute low-complexity network calls on behalf of the appliance. By leveraging this unauthorized path, external actors can force the device to query trusted internal endpoints and trigger unauthorized operations that normally require administrative credentials. Alongside this flaw, SonicWall patched CVE-2026-102256, an authenticated OS command injection bug also discovered by researcher Benoît Sevens. The release also covers CVE-2026-102257 and CVE-2026-102258, which represent path traversal and cross-site scripting vulnerabilities in the Appliance Management Console discovered by Brian Mariani. The impacted lineup consists of the 6210 and 7210 hardware appliances as well as the virtual 8200v platform. Neither the SMA 100 series nor the core SonicOS firewall SSL-VPN stacks share this vulnerable codebase. While vendor telemetry has not yet identified active exploitation, internet scans by Shadowserver revealed over 400 exposed SMA1000 installations visible online. SonicWall has urged administrators to immediately deploy hotfixes 12.4.3-03670, 12.5.0-03082, or later releases. This update follows a persistent assault on the platform throughout 2026, including zero-day chains CVE-2026-15409, CVE-2026-15410, CVE-2026-83548, and CVE-2026-83549, which delivered custom payloads such as `OrangeTail` and `RootRun`.

high1 source

DNS Rebinding in Draw.io ProxyServlet Allows Cloud Metadata and Internal Network Bypass

A server-side request forgery vulnerability has been disclosed in the proxy functionality of draw.io, enabling attackers to bypass private IP blocklists via DNS rebinding. The vulnerability manifests specifically in deployments where the proxy feature is activated through the `ENABLE_DRAWIO_PROXY=1` configuration flag. The root cause lies in how the application performs domain name resolution across two distinct execution stages without maintaining shared state. When handling an incoming request, the `Utils.sanitizeUrl()` method first invokes `InetAddress.getByName(host)` to confirm that the destination IP does not belong to private or restricted network blocks. Once the sanitization check completes successfully, execution flows to `ProxyServlet`, which instantiates a fresh `URL` object and invokes `url.openConnection()`. This operation initiates a completely independent, secondary DNS resolution process within the JVM. An attacker controlling an authoritative nameserver configured with a Time to Live (TTL) of zero can serve a benign public IP address during the initial validation check. The attacker then rapidly flips the DNS record to an internal IP address before the second lookup executes. Because the JVM's DNS caching TTL can be configured as low as zero, this race condition is reliably exploitable in practice. Successful exploitation allows attackers to force the server to issue HTTP requests to internal endpoints such as the cloud instance metadata service at `169.254.169.254`. The application subsequently base64-encodes the fetched response body and returns it directly to the requester. This behavior permits the exfiltration of sensitive cloud tokens, such as AWS IMDSv1 temporary IAM credentials or GCP service account tokens, as well as the probing of intranet services.

← all articles