CVE-2026-6744

Executive Summary

CVE-2026-6744 is a Server-Side Request Forgery (SSRF) vulnerability in Bagisto, an open-source e-commerce platform built on Laravel. The flaw resides in the copy function of the Downloadable Link Handler component, affecting versions up to 2.3.15. An unauthenticated attacker can exploit this vulnerability remotely to make the server send crafted requests to internal or external resources, potentially leading to data exfiltration, internal network scanning, or further compromise. The exploit has been publicly disclosed, and while the vendor has acknowledged the issue, no official patch has been released as of this report. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of the exploit increases the risk.

Supply Chain & Package Security

Bagisto is a PHP/Laravel application distributed via Composer. The vulnerability affects the core application code, not a third-party package. However, organizations using Bagisto should verify their deployment version and apply any security advisories from the vendor. The lack of a patch means that supply chain risk is elevated, and users must rely on workarounds or custom patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low-level information disclosure, limited data manipulation, and potential service disruption. However, SSRF can be chained with other vulnerabilities to escalate impact.

Deep Dive & Mechanics

The vulnerability exists in the copy function of the Downloadable Link Handler. This handler is responsible for processing downloadable product links, which may include URLs to external resources. The function fails to properly validate or sanitize user-supplied URLs before making HTTP requests to them. An attacker can craft a malicious request that causes the server to make requests to arbitrary internal or external hosts.

Technical Details:

• Affected Component: app/Http/Controllers/Admin/DownloadableLinkController.php (or similar path)
• Vulnerable Function: copy (likely used to duplicate downloadable links)
• Root Cause: Lack of URL validation and missing restrictions on redirects or internal IP ranges.
• Attack Vector: HTTP POST request to the vulnerable endpoint with a crafted url parameter pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).
• Impact: The server will fetch the URL and potentially return the response to the attacker, enabling information disclosure.

Example Request:

POST /admin/downloadable-links/copy HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

url=http://169.254.169.254/latest/meta-data/

Vulnerable vs. Patched Code

Vulnerable Code (Bagisto <= 2.3.15):

public function copy(Request $request)
{
    $url = $request->input('url');
    $response = Http::get($url); // No validation
    return response()->json(['data' => $response->body()]);
}

Patched Code (Expected Fix):

public function copy(Request $request)
{
    $url = $request->input('url');
    // Validate URL scheme and host
    if (!filter_var($url, FILTER_VALIDATE_URL) || !in_array(parse_url($url, PHP_URL_SCHEME), ['http', 'https'])) {
        return response()->json(['error' => 'Invalid URL'], 400);
    }
    // Block internal IPs
    $host = parse_url($url, PHP_URL_HOST);
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        return response()->json(['error' => 'URL not allowed'], 400);
    }
    // Use a whitelist of allowed domains if possible
    $response = Http::get($url);
    return response()->json(['data' => $response->body()]);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Bagisto <= 2.3.15
• Network access to the admin endpoint (may require authentication depending on configuration)

Exploitation Steps:

1. Identify the vulnerable endpoint: /admin/downloadable-links/copy
2. Craft a POST request with a malicious URL:

   curl -X POST https://target.com/admin/downloadable-links/copy \
     -d "url=http://169.254.169.254/latest/meta-data/"
   

3. If successful, the response will contain cloud metadata (e.g., AWS credentials).
4. For internal network scanning, use URLs like http://192.168.1.1/ or http://10.0.0.1/.

Lab Setup:

• Use Docker to deploy a vulnerable Bagisto instance:

  docker run -d -p 80:80 bagisto/bagisto:2.3.15
  

• Alternatively, use a local PHP development environment with Laravel.

Blue Team

Detection:

• Monitor for POST requests to /admin/downloadable-links/copy with unusual url parameters.
• Look for outbound HTTP requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on responses containing cloud metadata or internal service banners.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests to internal IPs.
• Apply a virtual patch by modifying the copy function to validate URLs (see patched code).
• Restrict outbound network access from the application server using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x)
  • Requests to cloud metadata endpoints (e.g., http://169.254.169.254/)
  • Unusual url parameters in POST requests to /admin/downloadable-links/copy

• File IOCs:

  • Log entries in Laravel logs (storage/logs/laravel.log) showing failed or successful requests to internal IPs.

• Behavioral IOCs:

  • Unexpected outbound connections from the web server to internal services.
  • Increased latency or errors when the server attempts to connect to non-existent internal hosts.

Detection Engineering

YARA Rule

rule CVE_2026_6744_SSRF_Bagisto {
    meta:
        description = "Detects SSRF exploitation attempts against Bagisto CVE-2026-6744"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-6744"
    strings:
        $url_param = "url=" nocase
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $cloud_metadata = "169.254.169.254"
        $endpoint = "/admin/downloadable-links/copy"
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-6744 SSRF Attempt Against Bagisto
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Bagisto's downloadable link copy endpoint with internal IP URLs.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/downloadable-links/copy
        cs-uri-query|contains: "url="
    filter:
        cs-uri-query|contains:
            - "url=http://10."
            - "url=http://172.16."
            - "url=http://172.17."
            - "url=http://172.18."
            - "url=http://172.19."
            - "url=http://172.20."
            - "url=http://172.21."
            - "url=http://172.22."
            - "url=http://172.23."
            - "url=http://172.24."
            - "url=http://172.25."
            - "url=http://172.26."
            - "url=http://172.27."
            - "url=http://172.28."
            - "url=http://172.29."
            - "url=http://172.30."
            - "url=http://172.31."
            - "url=http://192.168."
            - "url=http://169.254."
    condition: selection and filter
falsepositives:
    - Legitimate use of internal URLs for testing (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-6744 Bagisto SSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/downloadable-links/copy"; http_uri; content:"url="; http_client_body; pcre:"/url=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Remove or comment out the copy function in DownloadableLinkController.php.
2. Apply a virtual patch using a WAF to block requests containing internal IPs in the url parameter.
3. Restrict outbound network access from the web server using firewall rules (e.g., allow only necessary external IPs/domains).

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Implement proper URL validation and sanitization in all functions that make HTTP requests based on user input.
• Use a whitelist of allowed domains for downloadable links.

Workaround:

• Modify the copy function to only accept URLs from a predefined list of trusted domains.

Valters IT
Cyber Threat Intelligence & DevSecOps

{/* [Security Hash: 6EBB7646CAF0B3014A6AD868] */}