Emlog Pro TLS Certificate Validation Bypass

Emlog Pro versions through 2.6.23 contain a critical security flaw in the file include/service/ai.php where TLS certificate validation is unconditionally disabled. The application sets both CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to false in several core methods, including sendStream(), sendImageRequest(), send(), and fetchSearchHtml(). This configuration error impacts all outbound HTTPS requests to configured LLM providers.

Because there is no option to re-enable verification, any network-adjacent attacker positioned to intercept the traffic can present an arbitrary TLS certificate to the Emlog Pro server. This facilitates a man-in-the-middle (MitM) attack, enabling the unauthorized extraction of Authorization Bearer API keys transmitted in outbound headers and the injection of malicious content into AI responses. This is particularly dangerous as the application passes these responses through a tool-call execution pipeline, potentially granting an attacker control over system configuration via functions like query_database or update_config.

Impact

The vulnerability poses a high risk to organizations using Emlog Pro as an interface for LLM services. Successful exploitation allows for the theft of proprietary or high-value API keys used for AI integrations. Furthermore, the ability to inject AI responses means an attacker can manipulate the application's automation logic, potentially leading to unauthorized data exfiltration from connected databases or administrative system changes.

Recommendation

1. Audit network traffic for Emlog Pro instances to identify connections to unusual or suspicious LLM endpoints.
2. Implement network-level segmentation or mTLS to restrict communication between the web server and external providers until the vendor provides a patch.
3. Rotate all API keys associated with Emlog Pro AI services immediately if exposure is suspected.
4. Monitor logs for unexpected database queries or unauthorized configuration changes initiated through the AI service module.