| Título | smrealms project contributors smr (Space Merchant Realms open-source game engine) commit 9f7c8a9 Server-Side Request Forgery (SSRF) — CWE-918 |
|---|
| Descripción | Title: smr AlbumEditProcessor — SSRF via 'website' Field on Player Profile
Location: src/pages/Account/AlbumEditProcessor.php, the isUrlReachable() helper at line ~15..32 and the build() method that calls it at line ~35..50. The class extends AccountPageProcessor and is reachable by any logged-in player account (no admin role required).
What the bug is: The Album Editor accepts a free-form website field from the request, optionally prepends http:// (when no scheme is present), and validates the URL through a curl reachability probe with a 5-second timeout. curl_init() and curl_exec() are issued against the attacker-controlled URL with CURLOPT_FOLLOWLOCATION disabled (only a basic boolean check is enforced). The validation only checks that the URL is reachable; it does not parse the host, does not resolve the hostname, does not validate the resolved IP against RFC1918 / loopback / link-local / multicast / reserved ranges, and does not disable scheme flipping on redirect. Persisted on the player profile, the URL is re-fetched whenever the album is displayed, so the SSRF persists across sessions. CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 MEDIUM.
How to exploit: Step 1 — register or log into any player account on the target smr server: curl -c jar -b jar -X POST "https://victim.example/login.php" -d "login=user&password=...". Step 2 — submit the album form with a website value that points to the IMDS endpoint (or any internal host): curl -b jar -X POST "https://victim.example/account.php?edit=1" --data-urlencode "location=foo" --data-urlencode "website=http://x.x.x.x/latest/meta-data/iam/security-credentials/" --data-urlencode "day=1" --data-urlencode "month=1" --data-urlencode "year=2000". Step 3 — observe that the PHP process issues curl_init() and curl_exec() against the IMDS endpoint. On EC2 with IMDSv1 the request leaks IAM credentials back to the server (and into the persisted profile). Step 4 — revisit any page that displays the album; the SSRF is re-fired on every render. The PoC documents the exploitability, not the exploitation.
Impact: 1. Read access to internal HTTP endpoints reachable from the PHP worker. 2. Reconnaissance of internal network topology (timing, status codes). 3. Persistence: the URL is stored on the player profile and re-fetches whenever the album is displayed. 4. Pivots toward full data exfiltration when chained with another vulnerability.
Remediation: 1. Restrict the scheme allow-list to https only — never accept http:// from a user-supplied URL (or at minimum require https for any non-loopback host). 2. Resolve the hostname through gethostbyname() and reject any IP inside RFC1918 / loopback / link-local / multicast / reserved ranges. 3. Re-resolve immediately before curl_exec() to defeat DNS rebinding. 4. Keep CURLOPT_FOLLOWLOCATION disabled and re-validate manually if redirects are ever allowed. 5. Stop persisting attacker-supplied URLs (use only the relative URL scheme + hostname of the player's own server, or refuse to persist them entirely). |
|---|
| Fuente | ⚠️ https://github.com/smrealms/smr |
|---|
| Usuario | Plus0ne_27 (UID 101324) |
|---|
| Sumisión | 2026-09-17 16:52 (hace 1 mes) |
|---|
| Moderación | 2026-10-19 15:59 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 422345 [smrealms smr hasta f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d Album Website AlbumEditProcessor.php isUrlReachable website escalada de privilegios] |
|---|
| Puntos | 19 |
|---|