Description

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-10-09T10:16:38.970Z",
  "pubdate": "2026-10-09T10:16:38.970Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) Policy Manager is impacted by a Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation of user-supplied input.\nThe vulnerability allows a high-privileged, remotely authenticated attacker to manipulate the server into making unauthorized requests to internal or external resources.\nThis flaw resides in versions prior to 5.34.00.16 and poses significant risk by enabling potential reconnaissance of internal network infrastructure and unauthorized information disclosure.\nSuccessful exploitation requires the attacker to possess elevated privileges within the application environment, allowing them to abuse the functionality that facilitates outgoing network connections.\nBy redirecting the server's request-making capabilities, an attacker can bypass traditional network segmentation to interact with services otherwise protected by firewalls, access control lists, or those only accessible via localhost.\nThe scope of impact includes unauthorized data exfiltration, service enumeration, and the potential for leveraging the SCG server as a proxy to conduct further attacks against internal systems.",
  "technicalDetails": "The vulnerability originates within the Policy Manager component of the Dell Secure Connect Gateway (SCG), which lacks robust sanitization and validation protocols for input fields that dictate outbound connection endpoints.\nWhen an application processes a URL or an address-based request from a user, failure to properly whitelist destinations or validate the scheme can allow an attacker to inject arbitrary URIs.\nIn this context, the SCG server acts as an intermediary, initiating requests on behalf of the attacker. Because these requests originate from the trusted SCG server's interface, they are often implicitly trusted by other internal services.\nThe attack flow proceeds as follows: First, a high-privileged attacker identifies a functional module within the Policy Manager that allows for the submission of external service requests. Second, the attacker manipulates the parameters associated with these requests, substituting legitimate endpoints with target internal resources (e.g., internal APIs, metadata services, or administrative web interfaces).\nOnce the request is submitted, the server processes the payload and initiates a connection to the specified target. The underlying HTTP client or library utilized by the SCG application executes the request, potentially bypassing perimeter defenses such as firewall rules that govern host-to-host connectivity. The server then receives the response from the targeted resource and potentially returns parts of the response to the attacker, leading to information disclosure.\nThe vulnerability is technically categorized as Server-Side Request Forgery (SSRF) because the application fails to restrict the server from reaching unintended network locations. By forcing the server to reach internal network segments, an attacker can perform service discovery, fingerprint internal systems, or exploit non-public interfaces that rely on IP-based authentication.\nGiven that this vulnerability requires high-privileged access, the attack is specifically dangerous within multi-user environments or instances where administrative roles have been compromised. The ability to manipulate the server's outbound traffic behavior effectively turns the SCG instance into a pivot point for lateral movement and reconnaissance within the secure enclave.\nThe exposure is exacerbated if the SCG server resides in a network zone with broad internal access, as the SSRF primitive can be utilized to scan for and interact with sensitive services within the data center, including configuration management tools or local instance metadata services that might reveal further credentials or system artifacts."
}