CVE-2023-46725

Summary

CVE-2023-46725 is a serious vulnerability affecting FoodCoopShop, an open-source software used by food coops and local shops. Versions 3.2.0 to 3.6.0 are at risk, as they contain a server-side request forgery (SSRF) issue. In the Network module, a manufacturer account can manipulate the `/api/updateProducts.json` endpoint, prompting the server to send a request to an attacker-specified host, effectively turning the server into a proxy to the internal network. Additionally, there exists a time of check to time of use (TOCTTOU) issue related to inadequate image validation checks, resulting in a full SSRF. The vulnerability is fixed in version 3.6.1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.