Description

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-09-14T18:20:29.920Z",
  "pubdate": "2026-09-14T18:20:29.920Z",
  "executiveSummary": "A critical Server-Side Request Forgery (SSRF) vulnerability exists in the cors-proxy endpoint within Docs versions up to and including 5.6.1.\nThe vulnerability permits unauthenticated, anonymous attackers to force the application to initiate unauthorized outbound requests by supplying a valid public document UUID.\nBy exploiting this flaw, an attacker can bypass perimeter security controls, interact with services located within the internal network, and exfiltrate sensitive image data that would otherwise be protected from public access.\nThis vulnerability presents a high risk to the confidentiality and integrity of internal infrastructure, as the server acts as a proxy for malicious requests, potentially facilitating internal reconnaissance, exploitation of non-public services, or unauthorized data retrieval.\nExploitation requires no prior authentication or elevated privileges, making it accessible to any network-adjacent or external actor capable of interacting with the affected endpoint.",
  "technicalDetails": "The vulnerability resides within the cors-proxy functionality of the Docs application, specifically where the server validates and processes requests for document resources identified by a UUID. The root cause is the improper sanitization and validation of the target URL generated from the provided UUID, allowing an attacker to manipulate the server into making arbitrary outbound HTTP requests.\nThe exploitation mechanism leverages a combination of DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypass techniques. An attacker can craft a request that initially points to a benign or whitelisted host, but upon DNS resolution during the request execution, the target is swapped for an internal resource. Because the application logic does not perform strict validation of the final resolved destination, the proxy mechanism facilitates the bypass of internal access control lists.\nThe attack flow proceeds as follows: 1) The attacker identifies or generates a public document UUID to initiate the request process. 2) The attacker manipulates the request parameters to target an internal IP address or internal hostname that the server should not be accessing. 3) By utilizing DNS-based TOCTOU techniques, the attacker forces the underlying network stack to resolve the target domain to an internal address after the initial validation check has cleared. 4) The cors-proxy endpoint, acting as a trusted entity, executes the outbound request to the internal destination. 5) The server receives the response from the internal network resource—which may include internal application pages or administrative interfaces—and relays the content, such as image binary data, back to the attacker.\nThis vulnerability effectively renders the internal network segment vulnerable to interaction with the application server, allowing for unauthorized data exfiltration. Because the server itself is making the request, it bypasses traditional firewall rules designed to block direct external access to internal infrastructure. The lack of authentication requirements on the cors-proxy endpoint exacerbates the severity, allowing any anonymous user to conduct reconnaissance or leverage the server as a pivot point for further internal network attacks."
}