CordysCRM 1.7.3 contains an SSRF vulnerability in the ApprovalResourceService.sendWebHook function. This function reads a webhook URL from stored approval-node configuration and passes it to HttpClientUtils without proper SSRF validation, unlike the optional testConnect path. A user with PROCESS_SETTING_ADD permission can exploit this by configuring an internal URL via POST /approval-flow/add, causing the server to request that URL when POST /approval-action/approve is executed. This can lead to unauthorized access to cloud metadata services, internal network scanning, and interaction with internal services. The issue is resolved in CordysCRM version 1.7.4.

An attacker with PROCESS_SETTING_ADD privileges can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or cloud metadata endpoints. This can result in unauthorized disclosure of sensitive information such as cloud metadata, enable internal network reconnaissance, and potentially interact with internal services that are not otherwise accessible externally. The vulnerability does not impact confidentiality of user input or availability directly but can lead to significant information exposure.

Upgrade CordysCRM to version 1.7.4 or later, where this SSRF vulnerability is fixed. Until the upgrade is applied, restrict PROCESS_SETTING_ADD permissions to trusted users only to reduce risk. Patch status is confirmed fixed in 1.7.4.