CVE-2021-3742
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in Chatwoot allows attackers to upload malicious SVG files containing SSRF payloads. When these files are used as avatars and opened in new tabs, they can trigger unauthorized requests to internal systems. All Chatwoot installations prior to version 2.5.0 are affected.
💻 Affected Systems
- chatwoot/chatwoot
📦 What is this software?
Chatwoot by Chatwoot
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to internal network services, potentially leading to data exfiltration, internal service enumeration, or chaining with other vulnerabilities for further compromise.
Likely Case
Attacker probes internal network services, accesses metadata services, or performs limited internal reconnaissance through unauthorized HTTP requests.
If Mitigated
Limited impact with proper input validation and network segmentation preventing access to sensitive internal resources.
🎯 Exploit Status
Exploit requires user interaction (opening SVG in new tab) but payload creation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0
Vendor Advisory: https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c
Restart Required: Yes
Instructions:
1. Update Chatwoot to version 2.5.0 or later. 2. Restart the Chatwoot application. 3. Verify the fix by checking the version and testing SVG upload functionality.
🔧 Temporary Workarounds
Disable SVG avatar uploads
allTemporarily disable SVG file uploads for avatars until patching is complete.
Modify Chatwoot configuration to restrict avatar file types to non-SVG formats
Implement WAF rules
allAdd web application firewall rules to block SVG files containing SSRF payload patterns.
Configure WAF to inspect SVG files for SSRF indicators like 'http://', 'https://', and internal IP patterns
🧯 If You Can't Patch
- Implement strict network segmentation to limit Chatwoot's access to internal resources
- Deploy content security policies (CSP) to restrict SVG execution contexts
🔍 How to Verify
Check if Vulnerable:
Check if Chatwoot version is below 2.5.0 and test SVG upload with SSRF payloads.Check Version:
Check Chatwoot admin panel or run appropriate version command for your deployment methodVerify Fix Applied:
Verify version is 2.5.0 or higher and test that SVG files no longer trigger external requests when opened.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Outbound HTTP requests from Chatwoot to internal IPs
- Multiple failed avatar upload attempts
Network Indicators:
- HTTP requests from Chatwoot server to internal services not normally accessed
- Unusual traffic patterns following SVG file access
SIEM Query:
source="chatwoot" AND (file_type="svg" OR uri_contains=".svg") AND (http_method="GET" OR http_method="POST")