# Discovering Full Read SSRF in Jamf (CVE-2021-39303 & CVE-2021-40809)

Post-auth SSRF in Jamf Pro's eduFeatureSettingsTest imageUrl parameter returned full HTTP responses, enabling AWS metadata credential theft in Jamf Cloud.

- Payout: Research
- Severity: high
- Program: Jamf Pro
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-39303, CVE-2021-40809
- Write-up quality: 7/10
- Original: https://www.assetnote.io/resources/research/discovering-full-read-ssrf-in-jamf-cve-2021-39303-cve-2021-40809
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-full-read-ssrf-in-jamf-cve-2021-39303-cve-2021-40809
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:high tech:aws technique:chained technique:source-review vuln:ssrf

**Target:** Jamf Pro web app endpoint eduFeatureSettingsTest.ajax
**Root cause:** User-controlled imageUrl parameter passed unsanitized into HTTPUtils.getBytesFromSSLMutualAuthEndpoint, which performs an outbound HTTP GET and returns the full response body base64-encoded.
**Steps:**
1. Authenticate to Jamf Pro and visit `/legacy/eduFeatureSettingsTest.html?id=0&o=r`
2. Submit form with `imageUrl=http://example.com&ajaxAction=ACTION_AJAX_REQUEST_PHOTO&session-token=...` to `POST /eduFeatureSettingsTest.ajax?id=0&o=r`
3. Observe response `<base64Image>` containing base64 of the fetched URL body
4. Point imageUrl at `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to retrieve AWS temp credentials in Jamf Cloud
**How found:** Enumerated web.xml routes for pre-auth surface, found none; pivoted to sink-to-source: identified the shared HTTPUtils HTTP client wrapper, grepped for getBytesFromSSLMutualAuthEndpoint, traced single caller in EducationStudentPhotoRepositoryImpl, then up to EduFeatureSettingsTestHTMLResponse reading request parameter imageUrl.
**Exploitation:** Authenticated attacker submits arbitrary URL to the photo-fetch AJAX endpoint; server fetches it and returns full body base64-encoded. Against Jamf Cloud (AWS-hosted), targeting the EC2 metadata IP yields IAM temporary security credentials for Jamf's AWS environment.
**Escalation:** Post-auth SSRF escalated to cloud credential theft via AWS IMDS reachable from the SaaS deployment.
**Insight:** In enterprise Java apps, grep for the shared HTTP client wrapper class and its methods, then trace callers upward — a single sink often has one reachable controller reading a raw request parameter.