CVE-2026-61529: Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contain an HTTP or HTTPS URL. When a staff member with submissions.view permission invokes POST /forms/{formId}/submissions/{submissionId}/files, GetFilesHandler passes the stored data to SubmissionFileExtractor in src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs, which calls HttpClient.GetAsync without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have IsPublic and IsEnabled set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 content are decoded locally without network requests. This issue is fixed in version 0.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Endatixto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Endatix versions prior to 0.7.0 are exposed when a form is both public and enabled. The vulnerable path also depends on staff using the submission-file retrieval endpoint for a stored submission.
What does an attacker need to do to cause a server-side request?
An unauthenticated attacker needs to submit well-formed JSON containing a file object with name, type, and content fields, where content is an HTTP or HTTPS URL. If reCAPTCHA v3 is configured, the anonymous submission must also pass it.
When is the outbound request actually made?
The request is delayed until a staff member with submissions.view permission invokes POST /forms/{formId}/submissions/{submissionId}/files. At that point, the server fetches the attacker-supplied URL.
Can the attacker directly read the response from an internal service?
No. The fetched response is placed in the ZIP provided to the staff viewer rather than returned to the anonymous submitter. Any disclosure to the attacker is therefore blind or indirect, such as through observable requests.