Server-Side Request Forgery in FeehiCMS

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in FeehiCMS up to version 2.1.1. It exists in the UEditor widget's catchImage function due to insufficient IP address validation in the saveRemote() function. The flaw allows attackers to send HTTP requests to the server's loopback interface (127.0.0.1) or other internal addresses by manipulating the source[] argument. The PHP filter used only blocks private network ranges but misses loopback and link-local addresses.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in FeehiCMS, check if the UEditor widget's catchImage function is accessible and if it allows requests to loopback or link-local addresses. Test by sending requests to 127.0.0.1 or 169.254.0.0/16 and observe if connections are attempted. Use tools like curl or wget to probe internal services (e.g., curl http://127.0.0.1:3306 for MySQL). Monitor server logs for unusual outbound requests or errors indicating failed connections to internal addresses.

• Check if the vulnerable file backend/widgets/ueditor/Uploader.php exists in FeehiCMS installations.
• Send test requests to loopback (127.0.0.1) or link-local (169.254.x.x) addresses to see if the server attempts connections.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform internal port scanning, access internal services like MySQL or Redis, or reach cloud metadata endpoints. They might also access restricted paths like assets/* due to a whitelist bypass. The vulnerability enables blind SSRF through error responses, allowing further attacks even if direct access is blocked.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services or cloud metadata, potentially exposing sensitive data. For GDPR, this may result in unauthorized data processing or breaches. For HIPAA, it could allow access to protected health information if internal systems are compromised. Non-compliance risks include fines and legal penalties due to inadequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the IP validation in backend/widgets/ueditor/Uploader.php to include FILTER_FLAG_NO_RES_RANGE and explicitly block loopback (127.0.0.0/8) and link-local (169.254.0.0/16) addresses. Remove any whitelist for the assets/* path and restrict requests to standard ports (80, 443). If an update is unavailable, disable the UEditor widget or restrict access to the catchImage function via firewall rules or web server configuration.

• Apply the patch by modifying the saveRemote() function to use stricter IP filtering.
• Disable the UEditor widget if an immediate patch is not feasible.

Useful 0 Not Useful 0