FOG kwetsbaar voor unauthenticated SSRF via `/fog/service/getversion.php`

The SSRF vulnerability in FOGProject's getversion.php allows an attacker to craft a malicious URL parameter that triggers the server to make requests to arbitrary internal or external resources. Because the vulnerability is unauthenticated, an attacker does not need valid credentials to exploit it. This could lead to the exposure of sensitive internal data, such as configuration files, database credentials, or even access to other internal services. The newService=1 parameter appears to be a key component in triggering the vulnerability, bypassing authentication checks. Successful exploitation could allow an attacker to map the internal network and identify other potential targets for further attacks.

Organizations utilizing FOGProject for imaging, cloning, and inventory management are at risk, particularly those running versions prior to 1.5.11. Shared hosting environments where FOGProject is deployed could be especially vulnerable, as an attacker gaining access to one instance could potentially exploit the SSRF vulnerability to access other hosted resources.

• linux / server:

journalctl -u fogproject | grep -i "getversion.php"

• generic web:

curl -I http://<fogproject_server>/getversion.php?newService=1&url=<arbitrary_url>

Check the response headers for unexpected redirects or connections to internal resources. • php: Review the getversion.php file for any modifications or suspicious code related to URL handling.

1. 2026-01-23Disclosure

   disclosure

1. Gereserveerd2026-01-21
2. Gepubliceerd2026-01-23
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-24138 is to upgrade FOGProject to version 1.5.11 or later, which contains the fix. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests to getversion.php with suspicious URL parameters, specifically those containing user-controlled URLs. Additionally, restrict network access to the FOGProject server to only necessary IP addresses and ports. Monitor FOGProject logs for unusual outbound requests originating from getversion.php. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked.