Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-05T19:17:25.147Z",
  "pubdate": "2026-11-05T19:17:25.147Z",
  "executiveSummary": "SuiteCRM is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper input validation within the CalendarAccount module. This flaw allows an authenticated attacker to manipulate the server_url parameter, forcing the application to perform unauthorized PROPFIND requests from the server's network context.\nThe vulnerability exists because the CalendarAccount::action_testConnection function fails to validate the host, address, or scheme of the user-provided URL before passing it to cURL. By exploiting this, an attacker can conduct internal service enumeration, access sensitive internal resources, or potentially exfiltrate cloud metadata from the hosting environment.\nThe scope of impact includes unauthorized information disclosure and network reconnaissance. As the application processes these requests internally, it bypasses network-level firewalls protecting internal segments. Exploitation requires valid authentication, significantly elevating the risk for environments where user access is provisioned. The issue is resolved in versions 7.15.2 and 8.10.2.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient sanitization of the server_url parameter handled by the CalendarAccount::action_testConnection function. During the test connection workflow, the application initiates a CalDAV operation, specifically utilizing the CalDAVProvider::makeCalDAVRequest() method to execute a PROPFIND request.\nThe application architecture fails to implement a blocklist or allowlist mechanism for the destination URI scheme or target host. Consequently, the cURL library receives an arbitrary, user-controlled URL without pre-validation. An attacker can supply a crafted URI pointing to local internal services (e.g., http://127.0.0.1:port), internal network infrastructure, or cloud provider metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/).\nThe attack flow proceeds as follows: 1) An authenticated user triggers the CalendarAccount test connection action. 2) The attacker injects a malicious payload into the server_url parameter. 3) The backend invokes CalDAVProvider::makeCalDAVRequest(), which executes the cURL operation. 4) The server performs a PROPFIND request to the target defined by the attacker. 5) The application captures the response, including non-success status bodies, and reflects this information back to the attacker's interface. By interpreting these responses, the attacker can verify the presence of internal services, extract header information, or read contents of responses from non-public endpoints.\nThis vulnerability is classified as SSRF, leveraging the server's identity to traverse trust boundaries. Because the request originates from the CRM server, it bypasses perimeter security, permitting access to endpoints that are restricted from external Internet traffic. The impact is significant, as it enables attackers to map the internal network topology and exfiltrate sensitive data or credentials stored in cloud instance metadata services. The vulnerability is present in all SuiteCRM versions prior to 7.15.2 and 8.10.2."
}