KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

Overview

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

• KodExplorer 4.0
• KodExplorer 4.1
• KodExplorer 4.2
• KodExplorer 4.3
• KodExplorer 4.4
• KodExplorer 4.5
• KodExplorer 4.6
• KodExplorer 4.7
• KodExplorer 4.8
• KodExplorer 4.9
• KodExplorer 4.10
• KodExplorer 4.11
• KodExplorer 4.12
• KodExplorer 4.13
• KodExplorer 4.14
• KodExplorer 4.15
• KodExplorer 4.16
• KodExplorer 4.17
• KodExplorer 4.18
• KodExplorer 4.19
• KodExplorer 4.20
• KodExplorer 4.21
• KodExplorer 4.22
• KodExplorer 4.23
• KodExplorer 4.24
• KodExplorer 4.25
• KodExplorer 4.26
• KodExplorer 4.27
• KodExplorer 4.28
• KodExplorer 4.29
• KodExplorer 4.30
• KodExplorer 4.31
• KodExplorer 4.32
• KodExplorer 4.33
• KodExplorer 4.34
• KodExplorer 4.35
• KodExplorer 4.36
• KodExplorer 4.37
• KodExplorer 4.38
• KodExplorer 4.39
• KodExplorer 4.40
• KodExplorer 4.41
• KodExplorer 4.42
• KodExplorer 4.43
• KodExplorer 4.44
• KodExplorer 4.45
• KodExplorer 4.46
• KodExplorer 4.47
• KodExplorer 4.48
• KodExplorer 4.49

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.