An authenticated attacker can exploit a markdown sanitization flaw in Snipe-IT to exfiltrate sensitive server files and perform unauthorized server-side HTTP requests.

This vulnerability involves improper sanitization of markdown image syntax, which allows an authenticated user to leverage the CommonMark parser and laravel-mail-auto-embed to perform file reads and SSRF. By injecting malicious syntax into checkout acceptance notes, an attacker can force the server to resolve local files or external resources.

The ability to read arbitrary files, including sensitive configuration files like the .env file containing the application key, poses a severe risk to confidentiality. An attacker who retrieves the application key can potentially achieve full application compromise or further escalate privileges. With a CVSS score of 8.5, this high-severity vulnerability warrants immediate attention to prevent unauthorized access to internal system credentials and sensitive data.

Immediate Action: Update the Snipe-IT installation to version 8.7.0 or later, which includes the necessary sanitization logic to resolve the vulnerability.

Proactive Monitoring: Monitor server logs for unusual HTTP requests or unexpected file access patterns originating from the application service account.

Compensating Controls: Deploy a Web Application Firewall with rules designed to detect and block malicious markdown or URL-based injection attempts in user-submitted note fields.

Public Exploit Available: Unknown.

Given the potential for full application compromise via the leakage of environment variables, this vulnerability presents a significant risk to organizational security. Administrators should prioritize the update to version 8.7.0 immediately to eliminate the underlying injection vector. Failure to patch may expose critical infrastructure credentials to authenticated users with malicious intent.