CVE-2021-40809
📋 TL;DR
CVE-2021-40809 is a Server-Side Request Forgery (SSRF) vulnerability in Jamf Pro that allows attackers to make unauthorized requests from the server to internal systems. This affects Jamf Pro deployments before version 10.32.0, potentially exposing internal networks and services to attackers who can interact with the authentication workflows.
💻 Affected Systems
- Jamf Pro
📦 What is this software?
Jamf by Jamf
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal systems, steal sensitive data, pivot to other network resources, or execute commands on internal servers via SSRF chaining.
Likely Case
Unauthorized access to internal HTTP services, metadata services (like AWS/Azure instance metadata), or internal APIs leading to information disclosure.
If Mitigated
Limited to unsuccessful SSRF attempts with proper network segmentation and egress filtering in place.
🎯 Exploit Status
Exploitation requires interaction with authentication workflows but is well-documented in public blogs. The SSRF technique is mature and commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.32.0
Vendor Advisory: https://docs.jamf.com/10.32.0/jamf-pro/release-notes/Resolved_Issues.html
Restart Required: Yes
Instructions:
1. Backup your Jamf Pro database and configuration. 2. Download Jamf Pro 10.32.0 or later from the Jamf Customer Center. 3. Follow the Jamf Pro upgrade documentation for your deployment type (on-premises or cloud). 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from Jamf Pro servers to only necessary internal services.
Authentication Workflow Restriction
allTemporarily disable or restrict access to affected sign-on workflows if possible.
🧯 If You Can't Patch
- Implement strict egress filtering on Jamf Pro servers to block unauthorized outbound requests
- Monitor network traffic from Jamf Pro servers for unusual outbound connections to internal services
🔍 How to Verify
Check if Vulnerable:
Check Jamf Pro version in the web interface under Settings > Global Management > Jamf Pro VersionCheck Version:
Check web interface or database for version informationVerify Fix Applied:
Confirm version is 10.32.0 or higher and test authentication workflows for SSRF behavior📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Jamf Pro server
- Authentication workflow errors or anomalies
Network Indicators:
- Jamf Pro server making requests to internal services not normally accessed
- HTTP requests to metadata services (169.254.169.254, etc.)
SIEM Query:
source="jamf-pro" AND (http_outbound OR metadata_request OR internal_service_access)🔗 References
- https://blog.assetnote.io/2021/11/30/jamf-ssrf/
- https://docs.jamf.com/10.32.0/jamf-pro/release-notes/Resolved_Issues.html
- https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/
- https://blog.assetnote.io/2021/11/30/jamf-ssrf/
- https://docs.jamf.com/10.32.0/jamf-pro/release-notes/Resolved_Issues.html
- https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/
