Description

Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-07T08:16:46.023Z",
  "pubdate": "2026-08-07T08:16:46.023Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Revenue Administration Türkiye's E-Signature application, specifically affecting versions from 2.4.4.0 before 2.5.1.0.\nThis security flaw allows a remote attacker to manipulate internal request parameters, forcing the vulnerable server to dispatch unauthorized HTTP requests to arbitrary internal or external destinations.\nThe primary impact of this vulnerability includes potential exposure of internal network resources, service enumeration, and unauthorized data access within the internal infrastructure hosting the e-signature services.\nThe risk implications are critical as successful exploitation may enable attackers to bypass perimeter security controls, interact with backend services that are not exposed to the public internet, and potentially pivot deeper into the internal network.\nAttacker capabilities involve crafting and submitting malicious input parameters designed to coerce the vulnerable server into initiating outbound connections to specified targets.\nExploitation requirements depend on the application accepting and improperly validating user-supplied URLs or network identifiers used in server-side communication channels.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization of user-supplied data that is subsequently utilized by the application to construct and execute outbound network requests.\nThe vulnerable component resides within the server-side logic responsible for handling network communications or fetching external resources for Revenue Administration Türkiye's E-Signature, spanning versions from 2.4.4.0 up to, but not including, 2.5.1.0.\nDuring a typical attack flow, an unauthenticated or authenticated attacker identifies an input vector where the application processes a URL or network location. The attacker submits a crafted payload containing a target URI pointing to internal services (e.g., http://127.0.0.1/admin or cloud metadata endpoints) or external systems.\nUpon receiving the payload, the vulnerable server fails to validate or restrict the destination address against a secure whitelist. Consequently, the internal application logic initiates a backend request using protocols such as HTTP or HTTPS toward the attacker-specified destination.\nThe payload behavior forces the server to act as a proxy, reflecting responses back to the attacker or executing blind requests to perform internal port scanning, service discovery, and interaction with internal APIs.\nPost-exploitation impact includes the potential retrieval of sensitive configuration data, internal service interaction, leakage of internal network topology, and potential remote code execution if internal endpoints suffer from secondary vulnerabilities."
}