Executive brief
1Panel-dev CordysCRM, an open-source AI-driven customer relationship management system, contains a security flaw in its third-party integration settings. An attacker with basic user permissions can trick the server into making unauthorized network requests to internal or external systems. This could allow an attacker to scan private internal networks, bypass firewalls, or access sensitive data from other services running in the same environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in 1Panel-dev CordysCRM up to version 1.4.1 within the Third Party Endpoint component. The vulnerability is located in the `TokenService.java` file, specifically affecting the processing of the `mkAddress` parameter in the `/organization/settings/third-party/edit` and `/organization/settings/third-party/test` endpoints. The application fails to validate or sanitize the `mkAddress` input before concatenating it into a URL for backend HTTP requests. An authenticated attacker with `SYSTEM_SETTING_READ` or `SYSTEM_SETTING_UPDATE` permissions can exploit this to perform internal network reconnaissance or access internal services. While the issue was reported to the maintainers, the project closed the report citing incorrect reporting procedures, and a formal patch has not been confirmed.
Affected products
- 1Panel-dev CordysCRM up to 1.4.1
Timeline
- 2026-06-13: disclosed: Vulnerability reported via GitHub issues #2685 and #2686
- 2026-07-19: advisory: CVE published and NVD record created