CVE-2026-5618: Kalcaddle KodBox SSRF Vulnerability

CVE-2026-5618 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in kalcaddle kodbox up to version 1.64. This vulnerability affects the shareMake/shareCheck component, where manipulation of the siteFrom and siteTo arguments can allow an attacker to initiate arbitrary server-side HTTP requests. The attack can be executed remotely, though exploitation is considered difficult due to the high complexity of the attack.

Critical Impact

Attackers can potentially access internal services, scan internal networks, or exfiltrate sensitive data by forcing the server to make requests to arbitrary destinations. The exploit is publicly available.

Affected Products

• kalcaddle kodbox up to version 1.64
• kodbox shareMake/shareCheck component

Discovery Timeline

• April 6, 2026 - CVE-2026-5618 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5618

Vulnerability Analysis

This vulnerability is classified as Server-Side Request Forgery (SSRF), categorized under CWE-918. SSRF vulnerabilities occur when an application can be manipulated into making HTTP requests to arbitrary destinations specified by an attacker. In the context of kodbox, the shareMake/shareCheck functionality does not properly validate or sanitize the siteFrom and siteTo parameters, allowing attackers to control the destination of server-side requests.

The vulnerability can be exploited remotely via the network, though the attack complexity is noted as high. Once exploited, an attacker could potentially:

• Access internal services not intended to be publicly accessible
• Scan internal network infrastructure
• Read sensitive data from internal resources
• Bypass access controls and firewalls
• Potentially pivot to other attacks based on accessible internal services

Root Cause

The root cause of this vulnerability lies in improper input validation within the shareMake/shareCheck component. The siteFrom and siteTo parameters are not adequately sanitized before being used to construct server-side HTTP requests. This allows an attacker to inject arbitrary URLs or internal IP addresses, causing the server to initiate requests to unintended destinations.

Attack Vector

The attack is network-based and can be executed remotely without requiring authentication. An attacker crafts malicious requests to the shareMake/shareCheck endpoint, manipulating the siteFrom or siteTo parameters to include internal resources or external attacker-controlled servers.

The SSRF attack flow typically involves:

1. An attacker identifies the vulnerable shareMake/shareCheck endpoint in kodbox
2. The attacker crafts a request with malicious siteFrom or siteTo values pointing to internal services (e.g., http://127.0.0.1:6379 for Redis, http://169.254.169.254 for cloud metadata)
3. The kodbox server processes the request and initiates an HTTP connection to the attacker-specified destination
4. The server returns the response content to the attacker, exposing internal data or confirming service availability

For detailed technical information, see the VulnPlus Note and VulDB entry.

Detection Methods for CVE-2026-5618

Indicators of Compromise

• Unusual outbound HTTP requests from the kodbox server to internal IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16-31.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 originating from the application server
• Unexpected network connections from the web server to internal services (databases, caches, administration interfaces)
• Log entries showing access to shareMake/shareCheck endpoints with unusual URL parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SSRF patterns in request parameters
• Monitor application logs for requests to shareMake/shareCheck containing suspicious URL patterns or internal IP addresses
• Deploy network intrusion detection systems (NIDS) to alert on unexpected outbound connections from web servers
• Use SentinelOne Singularity to detect anomalous network behavior from web application processes

Monitoring Recommendations

• Enable detailed logging for all requests to the kodbox share functionality
• Implement alerting for any outbound connections from the web server to non-whitelisted destinations
• Monitor DNS queries from the kodbox server for unusual or internal domain lookups
• Track egress network traffic patterns to identify data exfiltration attempts

How to Mitigate CVE-2026-5618

Immediate Actions Required

• Upgrade kodbox to a version newer than 1.64 once a patch is released by the vendor
• Implement network-level controls to restrict outbound connections from the kodbox server
• Apply web application firewall rules to block SSRF attack patterns
• Review and restrict access to the shareMake/shareCheck functionality if not required

Patch Information

The vendor (kalcaddle) was contacted about this disclosure but did not respond. As of the last update, no official patch has been released. Users should monitor the VulDB entry for updates on patch availability and apply vendor patches immediately when they become available.

Workarounds

• Implement strict input validation on the siteFrom and siteTo parameters using a whitelist approach
• Configure network segmentation to prevent the web server from accessing internal services directly
• Use egress filtering to block outbound connections from the application server to internal networks and sensitive cloud metadata endpoints
• Consider disabling the share functionality if it is not essential to operations

If network-level mitigations are applied, configure egress firewall rules to explicitly deny connections to internal IP ranges (RFC 1918) and cloud metadata services (169.254.169.254) from the kodbox application server.