SSRF Vulnerability in Craft CMS resource-js Endpoint

Executive Summary

This vulnerability exists in Craft CMS versions 4.x through 4.17.8 and 5.x through 5.9.14 in the `resource-js` endpoint. It allows unauthenticated users to proxy remote JavaScript resources by exploiting the way the application trusts the client-supplied Host header when the `trustedHosts` setting is not explicitly restricted.

An attacker can supply a malicious Host header, which influences the derived `baseUrl` used for prefix validation inside the `actionResourceJs()` function. This manipulation enables the attacker to make the server perform arbitrary HTTP requests, resulting in a Server-Side Request Forgery (SSRF) vulnerability.

The issue is fixed in versions 4.17.9 and 5.9.15.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to make the Craft CMS server send arbitrary HTTP requests to internal or external systems. This SSRF can be used to access internal services that are not normally exposed, potentially leading to information disclosure, unauthorized actions, or further attacks within your network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft CMS to versions 4.17.9 or later on the 4.x branch, or 5.9.15 or later on the 5.x branch, where the issue has been patched.

Additionally, explicitly restrict the `trustedHosts` configuration to prevent the application from trusting client-supplied Host headers, which can be exploited to perform SSRF attacks.

Useful 0 Not Useful 0