CVE-2023-35817 is a medium severity flaw (CVSS 5.0) in DevExpress. AsyncDownloader allows server side request forgery, meaning the server can be made to fetch addresses chosen by someone else. Versions before 23.1.3 are affected. Update to 23.1.3 or the fixed release in your branch.
What's affected
The CVE record says DevExpress before 23.1.3 is affected. Code White's list shows fixed releases by branch: 23.1.3, 22.2.6, 22.2.3, 22.1.9, 22.1.7 and 21.2.12.
DevExpress also published support tickets about configuration. The titles refer to improper default configuration in the Report and Dashboard Server leading to SSRF, and to web configuration that helps prevent SSRF in the Reporting, BI Dashboard and Office File API. Read them in addition to updating, because a configuration setting may matter as much as the version.
How to check if you're exposed
List the DevExpress packages used by each project:
dotnet list package | grep -i devexpress
In older solutions, check the version of the DevExpress DLLs in the deployed bin folder. Anything below the fixed release for your branch is in range.
Then look at network paths. SSRF matters most where the application server can reach internal services or cloud metadata endpoints. Check whether your app servers can reach those addresses, and whether outbound traffic is limited to the destinations they really need. An exploitability check, which looks at whether the vulnerable code path is actually used, helps rank this against other findings.
What to do now
- Find every application that uses DevExpress reporting, dashboard or office components.
- Update to 23.1.3 or the matching fixed release and rebuild.
- Read the DevExpress tickets on SSRF configuration and apply the settings they describe.
- Restrict outbound traffic from application servers to approved destinations, and block access to cloud metadata addresses where possible.
- Log outbound requests from the application so unexpected internal targets show up.
Why it matters
Server side request forgery (CWE-918) turns a server into a proxy. The application makes a network request on behalf of the user, and if the target is not checked, the user can point it at places only the server can reach, such as internal admin pages or cloud credential endpoints. The server's position inside the network is the thing being abused.
The record scores this 5.0 with low privileges required and a changed scope, because the impact lands beyond the vulnerable component, with a small integrity effect. It is one of three DevExpress issues published together with CVE-2023-35814 and CVE-2023-35815. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is updating enough on its own?
Update first, then read the vendor tickets on SSRF related configuration, because some protection depends on settings.
Why does network egress matter?
SSRF uses the server as the requester. Limiting where the server can connect shrinks what a forged request can reach.
Sources
Last reviewed: 19 October 2026.
