Attackers Can Trigger Server-Side Request Forgery with SVG Avatars in Chatwoot

CVE-2021-3742

Summary

A Server-Side Request Forgery (SSRF) vulnerability has been identified within the Chatwoot application, impacting all versions prior to 2.5.0. The flaw allows attackers to upload malicious SVG files containing SSRF payloads. When such an SVG is utilized as a user avatar and subsequently opened in a new tab, the SSRF can be activated, which may lead to unauthorized redirection to internal or external hosts. This vulnerability poses significant risks to web application security and requires prompt attention to prevent exploitation.

References