Server-Side Request Forgery in Feehi CMS

Executive Summary

Feehi CMS 2.1.1 has a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation fails to block loopback or link-local addresses, allowing attackers to make the server probe internal HTTP services by observing response differences.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in Feehi CMS 2.1.1, monitor network traffic for unusual internal requests originating from the UEditor catchimage endpoint. Check server logs for requests to loopback or link-local addresses like 127.0.0.1 or 169.254.0.0/16. Use tools like curl to test the endpoint manually: curl -v 'http://your-cms-domain.com/backend/web/static/js/plugins/ueditor/php/controller.php?action=crawler&source=http://127.0.0.1:9090/' and observe if the server responds differently to internal vs external requests.

Inspect the files mentioned in the vulnerability report: backend/web/static/js/plugins/ueditor/php/controller.php, action_crawler.php, and Uploader.class.php for improper IP validation logic.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker can exploit this by sending crafted requests to probe internal services. This may lead to information disclosure about internal network services, potential access to sensitive data, or enabling further attacks on internal systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Information disclosure may result in non-compliance with confidentiality and security controls mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Feehi CMS to the latest version if available. If not, apply input validation to the UEditor catchimage endpoint to block loopback (127.0.0.0/8), link-local (169.254.0.0/16), and private IP ranges. Restrict server access to internal services and implement network segmentation. Monitor logs for suspicious activity targeting internal addresses.

Useful 0 Not Useful 0