Webkul Krayin CRM v2.2.x contains a Server-Side Request Forgery vulnerability that enables authenticated attackers to probe internal infrastructure, posing a significant risk of unauthorized internal network reconnaissance.

The vulnerability exists in the /settings/webhooks/create component, where insufficient validation of user-supplied input allows an authenticated attacker to perform requests to internal resources. The CVSS vector (PR:L) confirms that an attacker must possess authenticated access to the application to trigger this flaw.

Successful exploitation allows an attacker to bypass perimeter security and interact with internal services that are not exposed to the public internet. With a CVSS score of 8.5, this high-severity flaw could lead to the exposure of sensitive internal data, configuration details, or further exploitation of backend systems, resulting in significant security degradation.

Immediate Action: Monitor official Webkul security advisories and the Krayin CRM GitHub repository for the release of a patch, and apply the update immediately upon availability.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed to the /settings/webhooks/create endpoint, specifically looking for internal IP addresses or non-standard ports in the webhook target parameters.

Compensating Controls: Implement strict egress filtering on the server hosting the CRM to prevent it from initiating connections to sensitive internal network segments or unauthorized external endpoints.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for internal network compromise, administrators should prioritize the remediation of this flaw. Until a vendor-supplied patch is available, organizations should restrict access to the CRM administrative interface to trusted internal users only and deploy egress filtering to minimize the impact of potential SSRF attempts.