Clientst0R
Monthly
Server-side request forgery in Client St0r through 3.17.586 lets any logged-in user - including read-only accounts - force the server to fetch arbitrary internal URLs through the Property URL Importer endpoint (POST /locations/<id>/import-property-from-url/). Because the pre-patch code only checked for an http:// or https:// prefix and used a plain requests.get() that followed redirects and honoured proxy environment variables, attackers could reach 127.0.0.1, RFC1918 hosts, and the 169.254.169.254 metadata endpoint, with failure exception text echoed back to the requester. Exploit code is publicly available, but no confirmed active exploitation (CISA KEV) is reported; upgrading to 3.17.587 resolves the issue.
Server-side request forgery in Client St0r through 3.17.586 lets any logged-in user - including read-only accounts - force the server to fetch arbitrary internal URLs through the Property URL Importer endpoint (POST /locations/<id>/import-property-from-url/). Because the pre-patch code only checked for an http:// or https:// prefix and used a plain requests.get() that followed redirects and honoured proxy environment variables, attackers could reach 127.0.0.1, RFC1918 hosts, and the 169.254.169.254 metadata endpoint, with failure exception text echoed back to the requester. Exploit code is publicly available, but no confirmed active exploitation (CISA KEV) is reported; upgrading to 3.17.587 resolves the issue.