Threat Intelligence Database

Appsmith versions prior to 1.99 have a vulnerability in the POST /api/v1/admin/send-test-email endpoint where attacker-controlled smtpHost and smtpPort parameters allow establishing a raw JavaMail TCP connection without IP validation. This bypasses the intended IP check filter that only applies to HTTP requests. Additionally, error messages from MailException are returned verbatim in API responses, enabling attackers to perform internal port scanning and service banner enumeration. This vulnerability is fixed in version 1.99.

A Server-Side Request Forgery (SSRF) vulnerability exists in appsmithorg's appsmith platform versions prior to 2.1. The issue arises because the HTTP host filter used by the REST API and GraphQL datasource plugins relies on an exact-match denylist rather than a comprehensive address-class check, allowing authenticated users to send outbound requests to loopback-bound services inside the container. This vulnerability is fixed in version 2.1.

Appsmith versions prior to 2.1 include a bundled Caddy reverse-proxy with an unauthenticated admin API bound to 0.0.0.0:2019 inside the container. Although this port is not exposed to the host by default, it is accessible from the Appsmith server process or via SSRF vulnerabilities. An authenticated low-privileged user can exploit this to fully replace the live Caddy configuration, effectively taking over the reverse proxy. This critical vulnerability is fixed in version 2.1.

Appsmith versions prior to 2.1 include a vulnerability where the bundled supervisord exposes an XML-RPC interface on port 9001, accessible externally via a reverse proxy. An authenticated administrator can retrieve the supervisor password through an API endpoint and then execute arbitrary OS commands inside the Docker container. This issue is addressed in version 2.1.