CVE-2021-41792

Vulnerability

A blind Server-Side Request Forgery (SSRF) vulnerability exists in Hyland's Alfresco Content Services (up to version 6.2.2.18) and Alfresco Transform Services (up to version 1.3). An attacker can upload a specially crafted HTML file that, when processed by the transformation engine, causes the server to make an unexpected HTTP request to an arbitrary internal or external URL. The vulnerability is blind because the response from the target is not returned to the attacker [1].

Exploitation

An attacker requires the ability to upload a crafted HTML file to an affected Alfresco instance. No authentication is explicitly required for upload if the instance allows anonymous uploads; otherwise, a user with file upload privileges is needed. The uploaded HTML file must contain a payload that triggers the transformation engine to make an outbound request to an attacker-controlled or internal URL. The exact sequence involves uploading the malicious file and then invoking a transformation operation that processes it [1].

Impact

Successful exploitation allows an attacker to induce the vulnerable server to send blind HTTP requests to internal network resources, which may be used for internal port scanning, discovery of internal services, or interaction with other systems that normally would not be reachable from outside. The vulnerability does not disclose the response to the attacker, limiting the immediate information gain but still enabling reconnaissance and potential chain escalation [1].

Mitigation

Hyland released fixes in the latest versions of Alfresco Content Services and Share User Interface, as of October 2021. The fixed versions include Alfresco Content Services 7.1 and later (or the corresponding patch releases for affected branches). Users should upgrade to the latest available release. No workaround was publicly disclosed; updating the transformation engine or disabling the transformation engine for untrusted files may reduce risk. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].