Sachertortephp
Monthly
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.