CVE-2026-122008 in Oqtane
Summary
by MITRE • 11/04/2026
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Oqtane Framework prior to version 10.3.0 contains a critical server-side request forgery vulnerability within the UploadFile endpoint of FileController.cs, which fundamentally compromises the integrity of server-initiated HTTP requests. This flaw arises from an insufficient validation mechanism when processing user-supplied input for URL parameters. Specifically, the application utilizes HttpClient.GetStreamAsync to fetch remote resources but fails to enforce strict constraints on the scheme, host, or IP address provided by authenticated registered users. By supplying a caller-controlled url parameter without sanitization, attackers can manipulate the server into acting as an open proxy, directing internal network traffic toward arbitrary destinations that would otherwise be inaccessible from external networks.
The operational impact of this vulnerability is severe, primarily enabling unauthorized data exfiltration and internal network reconnaissance. Attackers who have obtained valid credentials for registered user accounts can exploit this flaw to request sensitive internal resources such as cloud instance metadata services, which often contain authentication tokens, private IP addresses, and configuration details critical for further compromise. Additionally, the vulnerability allows attackers to target localhost-bound management interfaces or other internal microservices that are not exposed to the public internet but remain accessible from within the server environment. This capability effectively bypasses network perimeter defenses, allowing an external attacker with low-privilege access to pivot into deeper layers of the infrastructure.
The exploitation chain involves a multi-step process where the fetched response is saved as a file in the attacker's designated user folder and subsequently retrieved via the download endpoint. This mechanism ensures that the exfiltrated data remains accessible even if immediate retrieval from memory or temporary storage is restricted, providing a reliable channel for stealing sensitive information such as database credentials, internal API keys, or proprietary codebases. Furthermore, by varying the target URLs and analyzing response times or error messages, attackers can perform port scanning and service enumeration of internal hosts, mapping out the network topology and identifying additional attack surfaces within the organization's private infrastructure.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically reflecting weaknesses in input validation for URL schemes and hostnames as described under CWE-643 Improper Restriction of XML External Entity Reference or more broadly CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1598 Phishing for Intranet Credentials and potentially T1046 Network Service Discovery if used for enumeration purposes. The vulnerability highlights a common misconfiguration where trust is placed in authenticated users without verifying the legitimacy or safety of their requested resources.
Mitigation strategies must focus on implementing strict allow-listing mechanisms for URL schemes, hosts, and IP addresses before any network requests are initiated by the server. Developers should validate that the target host does not resolve to private IP ranges such as 10.x.x.x, 172.16-31.x.x, or 192.168.x.x, nor loopback addresses like 127.0.0.1 or ::1. Additionally, it is crucial to disable HTTP redirects by default in HttpClient configurations to prevent attackers from bypassing initial validation through redirect chains pointing to internal resources. Upgrading the Oqtane Framework to version 10.3.0 or later resolves this issue as it includes proper input sanitization and validation logic for all external-facing endpoints that handle user-supplied URLs.