CVE-2023-39110: 
rConfig vulnerability analysis and mitigation

rConfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs (NVD).

The vulnerability exists in the file www/lib/ajaxHandlers/ajaxGetFileByPath.php. The issue stems from insufficient validation of the path parameter, where the tainted input from the $filepath variable is passed to the file_exists function. After execution, the application sends a request to the URL specified by the path parameter, leading to SSRF. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD, GitHub Advisory).

When exploited, this vulnerability allows authenticated attackers to send unauthorized requests from the system to internal or external resources. This can lead to arbitrary file reads using the file:// protocol, potential access to internal services, and the ability to probe intranet web services (GitHub Advisory).

The vulnerability requires authentication to exploit. An example exploit involves sending a request to /ajaxGetFileByPath.php with a crafted path parameter, such as file://localhost/etc/passwd to read system files. The vulnerability can be verified using curl commands with valid authentication tokens (GitHub Advisory).