Executive Summary

This vulnerability affects Flarum, an open-source forum software, in versions prior to 1.8.16 and 2.0.0-rc.1. It arises because certain settings registered as LESS configuration variables (such as theme_primary_color and theme_secondary_color) are not properly restricted. These settings are directly interpolated into the LESS source code at compile time without sanitization, allowing an authenticated administrator to inject arbitrary @import directives into the compiled CSS.

Because the LESS parser processes these @import directives, an attacker can exploit this to perform local file inclusion (reading arbitrary files accessible by the PHP process) or trigger outbound HTTP(S) requests (server-side request forgery). This means an attacker with administrator access can manipulate the forum's CSS compilation to execute these attacks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to local file inclusion, allowing an attacker to read sensitive files on the server that the PHP process can access. Additionally, it can be used to perform server-side request forgery (SSRF), enabling the attacker to make unauthorized HTTP(S) requests from the server.

These impacts can compromise the confidentiality of sensitive data stored on the server and potentially allow further attacks or information gathering by the attacker. However, exploitation requires authenticated administrator access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Flarum to version 1.8.16 or later, or to version 2.0.0-rc.1 or later, where the issue has been patched.

This patch restricts the use of @import and data-uri() LESS features in all LESS config variables, preventing arbitrary file inclusion or server-side request forgery via crafted theme color values.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated administrator to perform local file inclusion (LFI) and server-side request forgery (SSRF), potentially exposing sensitive files accessible by the PHP process or internal network services.

Such unauthorized access to sensitive data or internal resources could lead to violations of data protection regulations like GDPR or HIPAA, which require strict controls over personal and sensitive information.

Because the attacker can retrieve data by accessing a publicly served CSS file, this could result in data leakage or unauthorized disclosure, impacting compliance with confidentiality and data security requirements.

Therefore, organizations using vulnerable versions of Flarum may face increased risk of non-compliance with standards that mandate protection of sensitive data and internal systems.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reviewing the compiled forum.css file served by the Flarum forum for any unexpected or suspicious @import directives that could indicate exploitation attempts.

Since the attack involves an authenticated administrator injecting arbitrary @import directives via LESS config variables such as theme_primary_color or theme_secondary_color, monitoring changes or unusual values in these settings can help detect exploitation.

There are no specific commands provided in the available resources to detect this vulnerability directly on your network or system.

Recommended detection steps include:

• Manually inspect the forum.css file for unexpected @import statements that could indicate local file inclusion or SSRF attempts.
• Audit administrator account activity and changes to LESS configuration variables, especially theme_primary_color and theme_secondary_color.
• Restrict and monitor administrator access to prevent unauthorized theme configuration changes.

Useful 0 Not Useful 0