Server-Side Request Forgery in Craft CMS

Executive Summary

CVE-2026-55791 is a vulnerability in Craft CMS versions 4.0.0-RC1 to 4.17 and 5.0.0-RC1 to 5.9 that allows Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint.

The issue arises because the default trustedHosts configuration is permissive, allowing an attacker to poison the Host or X-Forwarded-Host HTTP headers. This manipulation changes the application's base URL ($baseUrl), bypassing internal URL validation.

As a result, the backend HTTP client (Guzzle) fetches a malicious payload from an attacker-controlled server and returns it to the client with a Content-Type of application/javascript. This vulnerability manifests when the assetManager.cacheSourcePaths setting is false.

The attack involves three main flaws: permissive proxy trust enabling header injection, insecure HTTP client handling bypassing validation, and forced JavaScript content-type responses. An attacker can exploit this to perform Blind SSRF, Web Cache Poisoning, and Stored Cross-Site Scripting (XSS), potentially leading to Remote Code Execution (RCE) via session riding.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can have several serious impacts:

• Blind Server-Side Request Forgery (SSRF) allowing attackers to probe internal networks.
• Web Cache Poisoning, where malicious JavaScript is cached and served to authenticated users.
• Stored Cross-Site Scripting (XSS) attacks that execute malicious scripts in the context of authenticated administrators.
• Remote Code Execution (RCE) through session riding by stealing CSRF tokens and performing unauthorized plugin installations.

Overall, this can lead to full compromise of the Craft CMS control panel and potentially the underlying server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious requests to the `/actions/app/resource-js` endpoint that include manipulated Host or X-Forwarded-Host headers. An unauthenticated attacker may send requests with poisoned headers to trigger the SSRF and JavaScript injection.

Network or system detection can involve inspecting HTTP request logs for unusual or unexpected Host or X-Forwarded-Host header values targeting the vulnerable endpoint.

• Use tools like tcpdump or Wireshark to capture HTTP traffic and filter for requests to `/actions/app/resource-js`.
• Example command to search web server logs for suspicious header usage: `grep -i 'X-Forwarded-Host' /var/log/nginx/access.log | grep '/actions/app/resource-js'`
• Use curl to manually test the endpoint with manipulated headers: `curl -H 'Host: attacker.com' -H 'X-Forwarded-Host: attacker.com' https://your-craftcms-site.com/actions/app/resource-js -v`

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Craft CMS to a patched version where this vulnerability is fixed: version 4.18.0 or later, or 5.10.0 or later.

Additionally, review and tighten the `trustedHosts` configuration to avoid permissive defaults that allow header poisoning.

Ensure that the `assetManager.cacheSourcePaths` setting is not set to false, as the vulnerability manifests when it is disabled.

If immediate upgrade is not possible, consider implementing network-level protections such as blocking suspicious requests to the vulnerable endpoint or filtering manipulated Host headers.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Craft CMS allows an attacker to perform Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection, which can lead to Stored Cross-Site Scripting (XSS) and potentially Remote Code Execution (RCE). This can result in unauthorized access to sensitive data or manipulation of the application.

Such unauthorized access and data manipulation could impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Specifically, exploitation of this vulnerability could lead to data exposure or unauthorized actions within the CMS, potentially violating data protection requirements and security controls mandated by these regulations.

Useful 0 Not Useful 0