CVE-2023-39109: 
rConfig vulnerability analysis and mitigation

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs (NVD, GitHub POC).

The vulnerability exists in the doDiff() function within classes/compareClass.php. The issue occurs because the file www/lib/crud/configcompare.crud.php does not perform sufficient validation on the path_a parameter. The taint is introduced from the $url variable into the tainted function file, and after execution, it sends a request to the URL specified by the path_a parameter. The CVSS v3.1 base score is 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows authenticated attackers to perform arbitrary file reads using the file:// protocol and make requests to internal network services. This could lead to exposure of sensitive files and internal network enumeration (GitHub POC).

The vulnerability requires authentication to exploit. A proof of concept exists demonstrating how an attacker can read local files (like /etc/passwd) and make requests to internal services by manipulating the path_a parameter (GitHub POC).