An authenticated attacker can exploit improper input sanitization in Snipe-IT to exfiltrate sensitive configuration files and perform Server-Side Request Forgery (SSRF) attacks.

This vulnerability is an injection flaw (CWE-73) where the category EULA text field fails to sanitize malicious HTML or markdown inputs. An attacker with low-level authenticated permissions can trigger server-side file resolution via the mail auto-embed library, leading to unauthorized file access or SSRF.

The ability for an attacker to exfiltrate critical files, such as the .env configuration, poses a severe risk of credential theft and full system compromise. Given the CVSS score of 8.5, this high-severity vulnerability must be addressed immediately to prevent unauthorized access to sensitive internal data and potential lateral movement within the network.

Immediate Action: Upgrade to Snipe-IT version 8.7.0 or later to ensure the EULA text field is properly sanitized.

Proactive Monitoring: Review outgoing email logs and server access logs for anomalous requests or attempts to reference local file paths within EULA fields.

Compensating Controls: Implement strict egress filtering on the application server to prevent unexpected outbound connections and restrict the application service account permissions to prevent access to sensitive files like .env.

Public Exploit Available: Unknown

The severity of this flaw, combined with the potential for credential exfiltration, necessitates an immediate update to the latest stable version of Snipe-IT. Security teams should prioritize patching this vulnerability to close the injection vector and protect against potential SSRF and data theft attempts.