CVE-2020-35558
📋 TL;DR
This vulnerability is a Server-Side Request Forgery (SSRF) in the MySQL access check of MB connect line products, allowing attackers to scan internal network ports and potentially gather credential information. It affects mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual installations. Attackers can exploit this to map internal networks and discover sensitive information.
💻 Affected Systems
- mymbCONNECT24
- mbCONNECT24
- Helmholz myREX24
- myREX24.virtual
📦 What is this software?
Mbconnect24 by Mbconnectline
Mymbconnect24 by Mbconnectline
Myrex24 by Helmholz
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map internal networks, discover credentials for other services, and potentially pivot to compromise additional systems.
Likely Case
Internal network reconnaissance leading to discovery of other vulnerable services and credential harvesting.
If Mitigated
Limited to port scanning and information gathering without direct system compromise.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and tools exist for automated exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.11.2
Vendor Advisory: https://mbconnectline.com/security-advice/
Restart Required: Yes
Instructions:
1. Check current version. 2. Update to latest version from vendor. 3. Restart services. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to vulnerable systems and limit outbound connections
Firewall Rules
allBlock outbound connections from affected systems to internal networks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Deploy web application firewall with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check application version in admin interface - if version is 2.11.2 or earlier, system is vulnerable.Check Version:
Check via web admin interface or consult vendor documentationVerify Fix Applied:
Verify version is updated to later than 2.11.2 and test SSRF functionality is blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connection attempts from application server
- Multiple connection attempts to internal IP ranges
Network Indicators:
- Outbound connections from application server to unexpected internal services
- Port scanning patterns originating from application server
SIEM Query:
source_ip=application_server AND (dest_port=3306 OR dest_port=1433 OR dest_port=5432) AND action=connection_attempt