Server-Side Request Forgery in Craft CMS via GraphQL Asset Mutation

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 5.0.0-RC1 to 5.10.5 and 4.0.0-RC1 to 4.18.1. It occurs in the GraphQL save<Volume>Asset mutation where the system fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete, failing to block CGNAT (100.64.0.0/10) and NAT64 (64:ff9b::/96) IP ranges. The IP check happens after the request is made, allowing attackers to disclose internal HTTP content, force outbound requests to internal hosts, and enumerate services.

An attacker with a GraphQL token limited to asset creation can exploit this to read internal services or force requests to internal hosts including RFC1918, loopback, or metadata endpoints.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in Craft CMS, check if your system is running affected versions (>=5.0.0-RC1 and <5.10.6 or >=4.0.0-RC1 and <4.18.2). Review GraphQL logs for save<Volume>Asset mutations with external URLs. Monitor outbound requests to CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP requests originating from the server.

Useful 0 Not Useful 0

Impact Analysis

If you use affected Craft CMS versions, an attacker could access internal HTTP content, make unauthorized outbound requests to internal systems, or enumerate internal services. This could lead to data leaks, unauthorized access to internal APIs, or service disruption. The impact depends on your internal network configuration and exposed services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosures, or failure to maintain confidentiality and integrity of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Craft CMS to patched versions (5.10.6 or 4.18.2). If upgrading is not possible, disable the GraphQL save<Volume>Asset mutation endpoint. Implement strict IP allowlisting for outbound requests. Add additional SSRF protections like blocking CGNAT and NAT64 ranges at the network firewall level. Review and restrict GraphQL token permissions to least privilege.

Useful 0 Not Useful 0