PT-2023-7222 · Flarum+1 · Flarum+1
Adam Kues
·
Published
2023-08-16
·
Updated
2023-08-29
·
CVE-2023-40033
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Flarum versions prior to 1.8.0
Description
The issue allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. This is due to the behavior of the
intervention/image package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. An attacker can exploit this by uploading a file containing a URL and spoofing the MIME type, manipulating the application to execute unintended actions. This enables the attacker to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack.Recommendations
For versions prior to 1.8.0, upgrade to version 1.8.0 to resolve the issue.
As a temporary workaround for the SSRF aspect of the vulnerability, consider disabling PHP's
allow url fopen, which will prevent the fetching of external files via URLs.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Flarum
Intervention/Image