| عنوان | October CMS 4.3.4 (4.x branch, up to commit c1876c7) Server-Side Request Forgery |
|---|
| الوصف | An unauthenticated attacker can bypass the SSRF protection in the System\Classes\ResizeImages class of October CMS 4.x (up to 4.3.4) by encoding a private or reserved IPv4 address as an IPv6-mapped IPv4 address (e.g. ::ffff:127.0.0.1). The validateExternalImageHost() check relies on PHP filter_var() with FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE, which fails to detect private IPv4 addresses embedded in IPv6-mapped form. A crafted image URL such as http://[::ffff:127.0.0.1]:8080/x.jpg submitted through a user-controlled image field passes validation, and file_get_contents() connects to the mapped internal IPv4 address, enabling blind SSRF to localhost, private networks, and cloud metadata services (e.g. x.x.x.x). The publicly accessible /resize/{file} route requires no authentication. |
|---|
| المصدر | ⚠️ https://github.com/0xGenesi/CVE/blob/main/October_CMS_SSRF_IPv6_Mapped_IPv4_Bypass.md |
|---|
| المستخدم | chenhuanlin (UID 100424) |
|---|
| ارسال | 11/08/2026 09:39 AM (2 أشهر منذ) |
|---|
| الاعتدال | 27/09/2026 12:41 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410875 [October CMS حتى 4.3.4 SSRF Protection ResizeImages.php validateExternalImageHost تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|