Jamf pro security code#

But Shah warned against underestimating such bugs. Since it was a post- authentication bug, the SSRF vulnerability was not exploitable by attackers who didn’t have valid credentials. This enabled the researchers to have the Jamf server execute an arbitrary web request.

Jamf pro security code#

“My past experiences also taught me that when it is not possible to find sources in the code easily, to try and find the sinks and work your way backward to the source,” Shah said.Ī little more digging into Jamf’s source code led the researchers to a page that directly sent a user-supplied URL to the HTTP sink function. Making arbitrary requests through the Jamf server This pattern is worth reviewing because it can often lead to SSRF,” Shubham Shah, the co-founder and CTO of Assetnote, told The Daily Swig.

“From my experience, in most enterprise applications, there is a need to make HTTP requests to external sources. This became their window to SSRF attacks. Having found none, they sought post-authentication bugs, and during their probe, they found an HTTP sink function that made requests to external resources. They initially looked for pre-authentication vulnerabilities that would be accessible to attackers who did not have valid credentials in the system. Since Jamf Pro is usually exposed to the internet, the researchers became interested in potential vulnerabilities it could have.

The Assetnote researchers came across an on-premise installation of Jamf Pro while examining the attack surface of a client. It can lead to all kinds of malicious activity, including data theft and remote code execution. SSRF is a type of web security vulnerability that allows attackers to force a web server to make HTTP requests to arbitrary domains. Apple MDM service forced to execute arbitrary web requestsĪ vulnerability in Jamf Pro, a popular mobile device management (MDM) platform for Apple devices, allowed attackers to stage server-side request forgery (SSRF) attacks on the application’s servers, security researchers at Assetnote have found.