[Security] Sender can reveal Agents IP without user interaction

[Security] Sender can reveal Agents IP without user interaction

Hi,

I'm a little bit frustrated here. I reported a security issue (in my eyes)  to the bug-bounty program of Zoho. But it's being refused and the judgement is: "No security issue" . So that's why i'm publicing it here, curious what other people think about this.

The outline is that someone can mail our support desk and can get the following information:
  1. IP of the Agent (re)opening the ticket
    1. this IP is valuable information for hackers because it might be an Office or VPN ip
    2. The IP might reveal the location of an agent, depending how accurate the IP database is
  2. timestamp of ticket being opened
Just by using an img tag in the mail.  

To make things clear:
  1. I do not care about getting a bounty; I care for my agents and our organisation security
  2. It's not about the agent is manually opening a link in a ticket, it's about opening links without user interaction. 
  3. Zoho has read-receipt disabled by default. Obviously because of privacy reasons ..... This issue provides even more info then a read-receipt.
Some possible solutions:
  1. Zoho will sent all remote requests over a proxy. Gmail also does this, so you only see an Google ip address in the access log
  2. When ticket is created, add the image as base64 or something like that, so it won't be requested by http
  3. Make an option to disable this behaviour
My original report:

Hi,


We just found out that it's possible to get the ip-address from the Agent opening a ticket in Zoho Desk; no interaction is needed just opening the ticket is enough. Just embed (using the <img> tag an remote image and that's it.


The agent ip-adress should never be revealed to a sender because it introduces security risks.


Steps to reproduce:

  1. Put an image somewhare on a website (where you have access to webserver logs) and be sure you disable browser caching for this image! eg. https://example.com/remote.png
  2. Email to Zoho Desk and embed an image (img html tag). eg https://example.com/remote.png
  3. Tail the http log and grab on the image (remote.png) you just embedded
  4. Open the new ticket in Zoho Desk
  5. Watch the log and see the request
  6. Reload the ticket
  7. Watch the log and see the request


The caching part is important because this makes it possible to see when an agent has opened the ticket everytime. If browser cache is enabled you will only 1 request.


    • Sticky Posts

    • Live Webinar - Work smarter with Zoho Desk and Zoho Workplace integration

      Hello customers! Zoho Desk and Zoho Workplace are coming together for a webinar on 14th May, 2024. Zoho Workplace is a suite of productivity apps for email, chat, docs, calls, and more at one single place. Zoho Desk is closely integrated with a few tools
    • Apple iOS 17 and iPadOS 17 updates for Zoho Desk users

      Hello Zoho Desk users! Apple recently announced the release of iOS 17 and iPad OS 17. These latest OS updates will help you stay productive and efficient, through interactive and seamless user experiences. Zoho Desk has incorporated the updates to help
    • Zoho Desk Partners with Microsoft's M365 Copilot for seamless customer service experiences

      Hello Zoho Desk users, We are happy to announce that Zoho Desk has partnered with Microsoft's M365 to empower customer service teams with enhanced capabilities and seamless experiences for agents. Microsoft announced their partnership during their keynote
    • Zoho Desk Cheat Sheet For The Year-End

      Check out these Zoho Desk best practices to end this year on a high and have a great one ahead! #1 Set Business (Holiday) Hours - If you have limited working hours, please make sure you restrict your business hours or set them as holidays for the coming days. Let your customers know when you will, and won't, be available. #2 Update the Annual Holiday List - Check the holidays for the new year and update the holiday schedule. Usually, holidays from the current year will be carried over for the next
    • Deprecation of older versions of ASAP Mobile SDK | Zoho Desk

      Hello, everyone.    Greetings from Zoho Desk ASAP!   In order to continue to deliver the best and most secure experience to our mobile SDK users. On account of the recent enhancements and updates to the mobile SDKs, we have planned to mark the older versions
    • Recent Topics

    • Is Bigin Really Free - Confused by notifications?

      I started to look at Bigin as I was under the impression it was free, but as I started using it I kept getting messages that my trial period was X number of days and to upgrade. When I see something like this I assume I am not on a free version of anything
    • Sorting and previewing notes

      I use the method of sorting notes by edit date in both the desktop and android clients, newest notes on top. When I edit a note on Android and exit it to the notebook, it does not move to the very top. Only when I exit the notebook and enter it again,
    • Allow Multiple Scheduled Appointments with Zoho Support

      Dear Zoho Team, I hope you're doing well. First, thank you for introducing the option to schedule support calls via the Zoho CRM booking link. This has been a fantastic enhancement, eliminating the need for back-and-forth coordination when scheduling
    • Pivot table with Text values - "Matrix Report"

      User Story - As a user, I would like the ability to display textual data in a two-way table, matrix format (text datatypes, not numerical datatypes displayed as a dimension) One major feature missing from the Pivot tables in Zoho Analytics is the ability
    • Domain not usable

      We have not used this domain because the Chrome systems on our office devices are not compatible with your technology. I am sorry if no one has never advised you of this. Please cancel if it has not already been canceled. Ticket# 7526594 Please see
    • Bigin iOS, macOS and Android app update - File Cabinet

      Hello Everyone! In the most recent iOS (v1.7.1) and macOS (v1.5.1) updates of the Bigin app, we have included support for the File Cabinet functionality. You can access this feature as a topping within the web app (bigin.zoho.com) and conveniently use
    • Power of Automation :: Automatically close the associated tasks once the Issues are closed

      Hello Everyone, A Custom Function is a user-written set of code to achieve a specific requirement. Set the required conditions needed as to when to trigger using the Workflow rules (be it Tasks / Project) and associate the custom function to it. We have
    • Meeting vs Zoom and why we are moving

      Dear Meeting team,                                   I want to share my thoughts on Meeting vs Zoom and explain why we are moving back to Zoom for all our video conferencing, even though it is part of our Zoho One Subscription. 1). Video & Audio quality - We see a significant downgrade in video quality when using Meeting vs Zoom, even when using the same internet connections.  Meeting video is blurry and not sharp compared to Zoom.  Audio is also hit and miss on Meeting with frequent drop outs and
    • Import from GoHighLevel to Zoho CRM

      Has anyone been successful with this? I don't want to integrate with GoHighLevel just import/migrate everything over to Zoho
    • booking link that expires

      I have a suggestion that is  crucial. When i send booking URL to clients they keep the link and they book appointment whenever they want multiple times. You should give us the Booking URL feature. We should be able to send it and the user can use it only
    • Accessing Subform Data using getRecordByID

      I am getting data from Zoho Creator using deluge zoho.creator.getRecordByID task, from another application. The report contains a subform, and that subform is in the detail view of the report. I do not appear to have any subform data in the JSON response,
    • Track Contact's Employment/Account History

      Thank you in advance for all of your help! Is there a way, within Zoho, to keep track of a contact's employment history? For example, if John Doe is my contact at Account 1, but leaves the company and is hired by Account 2, can I... ...maintain John Doe as a former employee under Account 1, while simultaneously listing him as a current employee of Account 2? ...view John Doe's employment history on his contact page in addition to the account he is currently associated with? I'm sure there is a way
    • Pre-fill TO and CC fields for Email Templates

      This would be a game changer to be able to set either specific email addresses or merge fields based on deal role titles into email templates. Please pass this along to *hopefully* add to future features of Zoho CRM.
    • Leads and Deals Issue

      Hi! Is Zoho having trouble today? I've been experiencing issues today. When I move a deal to closed/won, it previously would require a closing date but today the screen just went blur and the closing date did not pop up. And then under leads, I was trying
    • QR codes in templates

      I'm excited about the new QR code generator. I have included a QR code that contains the record ID setting "${ID}" as input data. In the report detail it works perfectly but when printing it in a template the code is not shown.
    • How do I hide all leads from Standard users in my CRM ZOHO

      I want to configure my crm zoho in such a way that standard users will only see leads owned or assigned to them. How do I go about doing this? I have tried all i could, but nothing...can anyone help me?
    • Custom view for Milestones

      Hi, Just an idea for the future... would it be possible to create custom views for the Milestones view under Work Overview ? I usually need to look at this view filtered by project group but the filter doesn't remain when navigating away. A custom view
    • How to Implement Time-Based Filters in Zoho Workflows?

      Hi everyone, I’m looking for a workaround to implement time-based filters in Zoho workflows. Specifically, I need a workflow to trigger only within certain hours (e.g., between 10:00 AM and 8:00 PM, Sunday to Friday). Currently, Zoho workflows execute
    • is there a better way to routinely export my project timesheets?

      Hi there, I am somewhat happy with how Zoho books handles time.  One thing that is missing is more user driven control over my data.  I have a workflow where I constantly need to give customers feeds of work done.  So I pick a project, and would ideally
    • Portal Default View

      Hello! My company is about roll out portals for some users, but we were wondering if it was possible to set the Record Detail Page View to default to a custom view that we made. That way the information they need would be streamlined and easier to see.
    • Does zoho rest api support token exchange from microsoft entra id token

      i want to get access token from the Microsoft user token in rest api. so it is possible to exchange microsoft user access token to zoho's access token or auth token ( token should be user specific not super admin).
    • Important: DKIM verification needed for unauthenticated email domains

      Hi all, This post is to inform users who are currently using unauthenticated email domains as their sender email for their notifications. We have mandated DKIM verification for all domains used as sender email addresses for the outgoing emails by 01-Jan-2025.
    • How do I define a weekend

      I noticed the default for weekends does not seem to include Saturdays. How can i define weekends to include both Saturdays and Sundays? Thank you.
    • Assistance Required: Custom Model Record Not Visible in Zoho CRM Sandbox

      Dear Team, I hope this message finds you well. I have created a custom model in the Zoho CRM Sandbox account and am currently adding records to it using Python. While I am able to fetch the module data programmatically through Python, I am unable to see
    • Zoho Sign Product updates - H2 2024

      Hello! We have almost come to the end of 2024! Here's a list of features and enhancements that went live in the later half of the year. NOM 151 certification Witness signing Formula, conditional, and custom fields Zoho Sign's extension for Bigin by Zoho
    • Custom Status for Purchase Orders

      Currently Zoho books has functionality to create custom statuses for Sales Orders. Can this be extended to include custom status for purchase orders as well? It was a great decision to add this functionality to sales orders. Our use case is for tracking
    • Remove Address from credit card payment

      I would like to remove the need to add address when paying by credit card. I only want the customer to have to add their credit card details.
    • Top Menu Disappeared from Blog Page

      Hi, Our top menu disappeared at Blog Posts page. However, it's still visible any other page on the website. I attached two screenshots, so it can be understood clearly. How can we bring back top menu? Thanks, K.
    • Subforms and automation

      If a user updates a field how do we create an automation etc. We have a field for returned parts and i want to get an email when that field is ticked. How please as Zoho tells me no automation on subforms. The Reason- Why having waited for ever for FSM
    • My Zoho mail has been blocked for suspicious activity. cannot unblock it! need urgent help!

      Hi, I was accessing my email on an airplane which for some reason resulted in my mail being blocked. I have managed to unblock my incoming however outgoing is still blocked. I have contacted all your support emails but it still says contact support when I try to unblock outgoing emails. Its now been over 8 days with the same issue which is really serious as I'm not able to send several business emails during this period. I have followed all your steps to unblock this and contacted your support 5
    • Copy Widget to another Dashboard

      I can see the option to clone a widget to the same dashboard but is it possible to copy it to another dashboard?
    • Error while importing products Purchase Price: Value in the field does not match with the data type supported by us.

      I am trying to import items into zoho inventory using an excel spreadsheet. I keep getting this error Purchase Price: Value in the field does not match with the data type supported by us. no matter how i format the cells this comes up and will not import
    • Quotes Module - import data

      Hello Zoho, is it possible to import Quotes records? I was trying and i have no results. Raport shows no data imported. Could you help me please how to do it?
    • Year-End Wrap: Disconnect now; Reconnect later with Offline Mode

      🎄Happy Holidays🎄 Let's say you are travelling home to spend the holiday season with your loved ones. Before you even board the train, you check your phone only to find your inbox rapidly filling with urgent emails that need your attention. There’s no
    • Exploring SalesIQ's Top Features of 2024: An Insider's Look 🔍

      As we wrap up another year at Zoho SalesIQ, it's time to reflect on how far we've come. This year has been incredible for us in our journey to build a more powerful, flexible, and customer-centric engagement platform. We've introduced several features
    • Resource booking functionality questions

      I'm exploring the resource booking functionality in Zoho Bookings for my organisation's needs. I have a few questions about the available Zoho Bookings functionalities. Is it possible to force all users to sign up for an account before they book a resource?
    • How to create a Field with answers as Yes, No> Further if no is selected a new field to be visible to give details

      Dear All, I am creating a feedback form in HR Letter. The question is were you satisfied with the work allotted. Expected answer to this is Yes, No. Further if the response is no, then a field to be give to fill more details as to why no was selected.
    • Modify the way a phone number is shown in footer on ZOHO Booking Page

      The default display of the phone number field in the footer is not customer friendly - See image below. We would like it to use the accepted standards of phone number display: +61 (0)2 88545440, or allow us to choose. At the moment ZOHO Booking sets how
    • Zoho Bookings Multilingual ?

      Hello, Not sure if there is a way to do it currently, but it would be very helpful if Zoho bookings allowed multilingual translations so we could have our booking pages and notifications setup in multiple languages. Thanks,
    • Allow customers to choose meeting venue and meeting duration on booking page

      My business primarily involves one-to-one meetings with my clients. Given the hybrid-work world we now find ourselves in, these meetings can take several forms (which I think of as the meeting "venue"): In-person Zoom Phone call I currently handle these
    • Next Page