Possible SSRF in email server settings(SMTP mode)

Disclosed: 2017-05-15 14:28:12 By xifengweiyu To nextcloud
Medium
Vulnerability Details
Description: vul address `https://demo.nextcloud.com/xxx/settings/admin/additional`,when you change `smtp server address` ,you will get some different hints. Reproduce steps: 1.Go to `https://demo.nextcloud.com/xxx/settings/admin/additional`,choose `SMTP` mode 2.Set server address to "172.17.1.0`,then you will get screenshot(nextcloud1.png),it means not on the same network segment 3.Set server address to "172.17.0.0`,then you will get screenshot(nextcloud2.png),it means the address not exists or doesn't open any port to access 4.Set server address to "172.17.0.1` and port to empty,then the test email will send successfully! it means this host exists and opens a smtp port 5.Set server address to "172.17.0.1` and port to `22`,then you will get screenshot(nextcloud3.png),it means the address exists,but can not access to the port
Actions
View on HackerOne
Report Stats
  • Report ID: 222667
  • State: Closed
  • Substate: informative
  • Upvotes: 2
Share this report