# Advisory: Jamf Pro SSRF - CVE-2021-39303 & CVE-2021-40809

Authenticated SSRF in Jamf Pro's eduFeatureSettingsTest endpoint lets users fetch arbitrary URLs and read full responses, enabling internal pivoting and cloud metadata credential theft.

- Payout: Research
- Severity: high
- Program: Jamf Pro
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-39303, CVE-2021-40809
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:high tech:aws technique:legacy-endpoint vuln:ssrf

**Target:** Jamf Pro web endpoint /eduFeatureSettingsTest.ajax
**Root cause:** The imageUrl parameter of the eduFeatureSettingsTest AJAX photo action is fetched server-side without restricting destination, and the full HTTP response is returned base64-encoded in the base64Image XML tag.
**Steps:**
1. Authenticate to Jamf Pro and obtain a JSESSIONID and session-token.
2. Send `POST /eduFeatureSettingsTest.ajax?id=0&o=r` with body `imageUrl=http%3A%2F%2Fexample.com&ajaxAction=ACTION_AJAX_REQUEST_PHOTO&session-token=<token>`.
3. Read the response XML `<base64Image>` tag and base64-decode it to obtain the full HTTP response body of the requested URL.
4. Point imageUrl at internal hosts or cloud metadata (e.g. 169.254.169.254) to retrieve internal content or credentials.
**Exploitation:** An authenticated Jamf user submits a crafted imageUrl to the photo AJAX action; the server fetches the URL and returns the full response base64-encoded, allowing the attacker to read internal services and cloud metadata endpoints (e.g. AWS IMDS) to harvest credentials.
**Escalation:** Pivot from authenticated web access to internal network reconnaissance and cloud credential theft via metadata IP.
**Insight:** Legacy AJAX endpoints that fetch user-supplied imageUrl server-side and echo the full response (here base64 in XML) are prime SSRF; test legacy/edu endpoints behind auth for URL-fetch parameters.