SSRF in products of MB connect line and Helmholz

Vulnerability

An SSRF (Server-Side Request Forgery) vulnerability exists in the MySQL access check functionality of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through version 2.11.2 [2][3]. The flaw allows an attacker to make the application send crafted requests to internal or external hosts, effectively scanning for open ports and retrieving sensitive information about possible credentials.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted requests to the affected MySQL access check endpoint. No authentication is required, and the attacker only needs network access to the vulnerable service. The SSRF can be used to probe internal network services and extract credential-related data from the responses.

Impact

Successful exploitation enables an attacker to scan for open ports on internal systems and obtain information about possible credentials. This information leakage can be leveraged for further attacks, potentially leading to unauthorized access or lateral movement within the network.

Mitigation

The vulnerability is fixed in version 2.12.1 of the affected products [2][3]. Users should update to this version or later. No workarounds are documented in the available references.