Executive brief
Kity Minder is a mind mapping tool used to create and organize visual diagrams. A vulnerability in the image export feature allows attackers to make unauthorized requests to internal systems and external URLs, potentially exposing sensitive information or compromising network resources behind the application.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the ImageCapture.class.php file's init() function. The vulnerable component fails to validate the image parameter before passing it to curl_init(), allowing attacker-controlled URLs from $_REQUEST['data'] to be processed without restriction. An unauthenticated attacker can submit a crafted POST request to export.php with a malicious image URL, causing the server to make HTTP requests to arbitrary locations (internal IPs, private services, or external targets). The attack chain flows from export.php through Parser classes to ImageCapture::capture(), ultimately executing unvalidated curl requests. No patch information is available in the advisory.
Affected products
- Kity Minder kityminder 1.3.5 and earlier
Timeline
- 2022-05-25: disclosed: Vulnerability reported on GitHub
- 2022-06-10: advisory: GHSA advisory published
- 2022-06-09: other: NVD entry published