CVE-2023-6849

Executive Summary

CVE-2023-6849 is a critical server-side request forgery (SSRF) vulnerability in kalcaddle kodbox, a popular open-source web-based file manager and document management system. The flaw resides in the cover function of the plugins/fileThumb/app.php file, where the manipulation of the path argument allows a remote, unauthenticated attacker to force the server to make arbitrary HTTP requests to internal or external resources. All kodbox instances up to and including version 1.48 are affected, with version 1.48.04 providing the fix. Successful exploitation could lead to internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDS), or lateral movement within the hosting environment. A public disclosure and exploit details have been made available, elevating the urgency for remediation.

Technical Analysis

The vulnerability is a classic server-side request forgery (SSRF) flaw occurring in the cover function of the plugins/fileThumb/app.php file in kodbox. This plugin is responsible for generating file thumbnail previews, a core feature of the file management interface.

Vulnerability Class: SSRF (CWE-918)

The cover function accepts a path argument that is used to construct a resource locator for thumbnail generation. The application fails to validate or sanitize this argument before using it in a server-side HTTP request. An attacker can supply a path value pointing to an arbitrary URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://internal-server:8080/admin for internal network scanning) rather than a legitimate local file path.

The key characteristics of this vulnerability:

1. Attack Vector: Network-based, remotely exploitable via HTTP requests to the kodbox application.
2. Authentication: The NVD description does not indicate an authentication requirement, and the CVSS vector (AV:N/PR:N/UI:N) suggests no privileges are required.
3. The path Argument: The manipulation of this argument is the root cause. The application does not differentiate between a local filesystem path and a remote URL, and it blindly passes the value to an HTTP client or file retrieval mechanism that supports remote schemes (e.g., http://, https://, file://).

Affected Surface

The plugins/fileThumb/app.php file is part of the core kodbox plugin architecture. This endpoint is reachable through the web application's HTTP interface, making any internet-facing kodbox installation a potential target. The vulnerability was disclosed publicly, meaning the technical details of where and how to send the malicious request are available to potential attackers.

Patch Analysis

The fix for this vulnerability is contained in version 1.48.04. The associated patch commit is identified as 63a4d5708d210f119c24afd941d01a943e25334c. While the patch is referenced by a single source (OSV), the version bump suggests input validation and URL scheme allowlisting were likely introduced in the cover function. However, patch confidence is rated 2/4 (CLAIMED), meaning the fix has not been independently verified by a second source.

Exploitation Scenarios

The attack chain for CVE-2023-6849 follows a standard SSRF exploitation flow. No public PoC is confirmed, but the attack methodology is well-understood for this vulnerability class. The attack chain is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance and Target Identification

The attacker first identifies internet-facing kodbox instances. This is accomplished via search engines such as Shodan or Fofa using fingerprints like http.title:"kodbox" or by scanning for the application's distinctive login page. The default installation paths and known plugin structure (plugins/fileThumb/app.php) are publicly documented in the kodbox wiki and source code repositories.

Step 2: Triggering the Flaw

Once a target is identified, the attacker crafts an HTTP request to the vulnerable endpoint. The request targets the cover function within plugins/fileThumb/app.php and includes a path parameter containing a malicious URL. For example:

GET /index.php?plugin/fileThumb/cover&path=http://169.254.169.254/latest/meta-data/

Note: The exact URL structure above (including /index.php?plugin/fileThumb/cover) is inferred from the file path and function name provided in the NVD description. The actual routing mechanism may differ; the key point is that the path argument is attacker-controlled and results in a server-side HTTP request.

Step 3: Payload Execution

The server-side code retrieves the resource specified in the path argument without verifying that the target is a legitimate local file path. The server's HTTP client follows the URL, making a request from the server's network position to the crafted destination. Because the request originates from the kodbox server itself, it bypasses network perimeter controls that would typically block external access to internal resources.

Step 4: Post-Exploitation Impact

The impact depends on the target network topology:

• Cloud Metadata Theft: If kodbox is hosted on a cloud VM (AWS, GCP, Azure), the attacker can query the instance metadata service (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) to steal temporary credentials, which can be used to pivot into the cloud account.
• Internal Network Scanning: The attacker can scan and interact with internal services (databases, admin panels, internal APIs) that are not exposed to the internet, potentially discovering additional vulnerabilities or sensitive data.
• Data Exfiltration: The SSRF can be chained to read local files via the file:// scheme or to interact with internal file storage services.

Impact Assessment

CVSS Score: 7.3 (High)

The CVSS vector indicates a network-exploitable vulnerability (AV:N) requiring no authentication (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), but the confidentiality impact is high (C:H), meaning significant information disclosure is possible. Integrity and availability impacts are rated low (I:L/A:L).

Business Impact:

• Confidentiality Breach: The most severe impact is the theft of sensitive internal data, cloud credentials, or access to internal applications. This could lead to a full cloud account compromise if metadata service credentials are exfiltrated.
• Lateral Movement: The SSRF allows the attacker to pivot from the web-facing application into internal infrastructure segments, expanding the attack surface and potentially compromising other systems.
• Reputation Damage: For organizations using kodbox in a multi-tenant or customer-facing role, a successful exploit could result in data breaches, regulatory penalties, and loss of customer trust.

Affected Systems: All kodbox installations running version 1.48 or earlier. Given that kodbox is a popular open-source file manager (the successor to Kodexplorer), the user base includes small businesses, educational institutions, and self-hosted enterprise deployments.

Blast Radius: The internal network of the hosting environment. If kodbox is deployed on a shared hosting platform, the blast radius could extend to co-tenant systems and the hosting infrastructure itself.

Detection Guidance

Sigma Rule

title: Kodbax SSRF Exploitation Attempt via fileThumb cover
id: 9c6b5c2a-3d47-4e8a-9a42-1c2b3d4e5f60
status: experimental
description: Detects HTTP requests targeting kodbox fileThumb plugin with URL-like path arguments indicative of SSRF attempts
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6849
author: Valtersit Threat Intel
date: 2025/01/14
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for kodbox application'
detection:
    selection:
        cs-uri-extension: app.php
        cs-uri-query|contains:
            - 'fileThumb'
            - 'cover'
        cs-uri-query|contains|all:
            - 'path=http'
            - 'path=file://'
    filter:
        cs-uri-query|contains:
            - 'path=/var/'
            - 'path=/tmp/'
            - 'path=./'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate thumbnail generation for local files should use filesystem paths, not URLs. Minimal false positives expected.

YARA Rule

rule Kodbox_SSRF_CVE_2023_6849
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2025-01-14"
        description = "Detects web requests targeting kodbox fileThumb cover function with SSRF indicators"
        cve = "CVE-2023-6849"
        references = "https://nvd.nist.gov/vuln/detail/CVE-2023-6849"
    strings:
        $app = "fileThumb/app.php"
        $cover = "cover"
        $path_param = "path="
        
        $ipv4 = /path=https?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}/
        $imds = /path=https?:\/\/169\.254\.169\.254/
        $localhost = /path=https?:\/\/localhost/
        $internal_host = /path=https?:\/\/10\./
        $file_scheme = "path=file://"
        
    condition:
        ($app and $cover and $path_param) and
        (any of ($ipv4, $imds, $localhost, $internal_host, $file_scheme))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Kodbox SSRF Attempt (CVE-2023-6849)"; flow:established,to_server; content:"GET"; http_method; content:"app.php"; http_uri; content:"fileThumb"; http_uri; content:"cover"; http_uri; content:"path="; http_uri; content:"http"; http_uri; within:50; reference:cve,2023-6849; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-6849; classtype:attempted-info-leak; sid:20250114; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.action == "connection_attempted" and 
    destination.port == 80 and
    process.name != null and
    destination.ip != source.ip ]
  [ file where event.action == "read" and
    file.path contains "fileThumb" ]

Note: The EQL above is a generic pattern. A more specific detection using HTTP request-log data would look like:

any where process.name == "php" and
  event.action in ("execve", "start") and
  process.args : "app.php" and
  process.args : "*path=http*"

Splunk SPL Query

index=web sourcetype="access_combined"
| where uri_path LIKE "%fileThumb/app.php%" 
    AND uri_query LIKE "%cover%"
    AND (uri_query LIKE "%path=http%" OR uri_query LIKE "%path=file://%")
| table _time, src_ip, dest_ip, uri_path, uri_query, http_user_agent, status
| stats count by src_ip, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="732694" level="12">
    <if_sid>31100</if_sid>
    <match>fileThumb/app.php</match>
    <regex>path=(http|file://)</regex>
    <description>Kodbox SSRF exploitation attempt detected (CVE-2023-6849)</description>
    <group>attack_attempt,ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The fix in version 1.48.04 is reported by a single source (OSV) and has not been independently verified. Exercise caution and test thoroughly before deploying.

1. Immediate Mitigations (Apply within 24-48 hours):

• Apply the vendor patch immediately by upgrading to kodbox version 1.48.04 or later. This is the only confirmed remediation.
• If immediate upgrade is not possible, restrict network access to the kodbox web interface. Place it behind a VPN or firewall rule that limits access to trusted IP ranges only. This reduces the remote attack surface.
• Implement a Web Application Firewall (WAF) rule to block requests with URL-like path parameters targeting fileThumb/app.php.

2. Patch/Upgrade Steps:

• Back up the current kodbox installation and database.
• Download kodbox version 1.48.04 from the official repository.
• Follow the vendor's upgrade documentation to replace the application files.
• Verify the application functionality, especially file thumbnail generation.
• Confirm the version in the application footer or admin panel reads 1.48.04 or higher.

3. Long-Term Hardening:

• Network Segmentation: Ensure that kodbox is deployed in a DMZ with no direct route to production database or application servers.
• Cloud Metadata Protection: If running on AWS, enable IMDSv2 (which requires session tokens) to mitigate metadata theft via SSRF.
• Egress Filtering: Configure firewall rules to block outbound HTTP requests from the kodbox server to internal IP ranges (RFC 1918 addresses) and to the cloud metadata IP (169.254.169.254).
• Input Validation: Review application code to enforce allowlisting for the path argument — only local filesystem paths should be accepted, and URL schemes should be restricted to local file access.
• Monitoring: Implement continuous monitoring for SSRF patterns in web logs and outbound server-side connections.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-6849 — Official NVD record containing the CNA description and CVSS scoring.
2. VulDB Entry (VDB-248210): https://vuldb.com/?id.248210 — The original vulnerability disclosure containing the CNA title and technical details.
3. Patch Commit Reference: Commit ID 63a4d5708d210f119c24afd941d01a943e25334c — The specific fix in the kodbox repository, referenced in the NVD data.
4. kodbox Official Site: https://kodbox.com/ — Vendor resource for downloading version 1.48.04 and reviewing release notes.

Threat Actor Activity: As of the report date, CVE-2023-6849 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and there are no confirmed reports of exploitation in the wild. However, the vulnerability has a public exploit disclosure, and the EPSS score (0.00886) places it in the 56th percentile of exploited CVEs, suggesting modest but non-zero exploitation likelihood. Given the public disclosure and the widespread adoption of kodbox, active exploitation is anticipated in the near term. Security teams should prioritize patching and monitoring for exploitation attempts.