Server-Side Request Forgery in Oqtane Framework

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Oqtane Framework versions before 10.3.0. It exists in the UploadFile endpoint of FileController.cs where authenticated users can supply a malicious URL parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. This allows attackers to trick the server into fetching arbitrary internal resources like cloud metadata services or localhost-bound interfaces.

Useful 0 Not Useful 0

Detection Guidance

Detecting this SSRF vulnerability requires checking for unauthorized file uploads from external URLs. Inspect server logs for FileController.cs UploadFile endpoint requests with suspicious URLs. Look for files in user folders that were fetched from internal or unexpected sources. Monitor network traffic for outbound requests to localhost or cloud metadata services originating from the server.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to exfiltrate sensitive internal data by saving fetched responses as files in their user folder and downloading them later. They could also enumerate internal network hosts and ports, potentially mapping out internal infrastructure for further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Oqtane Framework version 10.3.0 or later to apply the official patch. Ensure all dependencies are updated, including .NET SDK and ImageSharp. Implement strict URL validation in FileController.cs to restrict allowed schemes, hosts, and IP addresses. Review and remove any unauthorized files in user folders that may have been created via this vulnerability.

Useful 0 Not Useful 0