Executive Summary

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in versions up to and including 4.30.0 when the 'prettyUrls: true' feature is enabled on '@apostrophecms/file'. This feature builds URLs using the raw 'Host' HTTP request header, which is attacker-controlled. The system then fetches the URL and streams the response back to the requester. Because the 'Host' header can be manipulated by an attacker, an unauthenticated remote attacker can cause the ApostropheCMS process to make outbound HTTP requests to any host accessible on the private network.

The vulnerability is limited by the path component, which is constrained to a specific pattern based on local database lookups, preventing cross-instance data exfiltration. However, it still allows blind Server-Side Request Forgery (SSRF) attacks, enabling attackers to map network topology through response codes, timing differences, and detailed error messages.

As of the publication date, no patched versions addressing this vulnerability are known.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to make the ApostropheCMS server send HTTP requests to arbitrary hosts within the private network. This can be used to perform network reconnaissance by mapping internal network topology through response codes and timing analysis.

Although the impact is somewhat limited because the path is constrained and cross-instance data exfiltration is prevented, the attacker can still gain information about internal network structure and potentially exploit other internal services.

The vulnerability has a CVSS base score of 3.7, indicating a low to medium severity impact, with limited confidentiality impact and no integrity or availability impact.

Useful 0 Not Useful 0