| शीर्षक | Poesis Inc. Rhymix CMS <=2.1.33 Server-Side Request Forgery |
|---|
| विवरण | Security Vulnerability Report: SSRF in Rhymix Data Import Module
1. Summary
• Vulnerability Type: Server-Side Request Forgery (CWE-918)
• Affected File: modules/importer/importer.admin.controller.php (Lines 34–85)
• Vulnerability Description: The importer admin controller directly uses fopen() to fetch files via HTTP when the filename parameter starts with http://. Since there is no whitelist restriction on target hosts or IP addresses, an authenticated administrator can abuse this functionality to launch SSRF attacks against internal services.
2. Analysis Logic
Step 1: Examine the Sink at modules/importer/importer.admin.controller.php:34-85
$filename = Context::get('filename');
...
if(strncasecmp('http://', $filename, 7) === 0)
{
if(ini_get('allow_url_fopen'))
{
$fp = @fopen($filename, "r");
...
}
...
$this->add('exists', $isExists);
}
The controller code opens any URL starting with http:// via fopen() and checks if the resource exists. The only prerequisite is that allow_url_fopen is enabled. No host validation, IP address restriction, or port limitation is implemented, allowing access to internal endpoints such as cloud metadata services.
Step 2: Trace How filename is Supplied via Admin Interface
• JavaScript Binding (modules/importer/tpl/js/importer_admin.js:10-76):
$('.checkxml')...find('button').click(function(){
...
$.exec_json('importer.procImporterAdminCheckXmlFile', {filename:$.trim($input.val())}, on_complete);
});
• Action Registration (modules/importer/conf/module.xml:5-10):
<action name="procImporterAdminCheckXmlFile" type="controller" />
The admin interface binds a button click event to send arbitrary user input from the textbox as the filename parameter. This action is registered as a valid controller endpoint, meaning any authenticated administrator (is_admin=Y) can exploit this endpoint with attacker-specified URLs.
Step 3: Trace Request Data to Context::get()
• Request Handling (classes/context/Context.class.php:1247-1310 & 2001-2025): directly copies raw $_GET/$_POST into Context::$_user_vars and Context::get() returns it without URL sanitization.
• Filter Logic: Only basic escaping, no parse_url, no whitelist, no private IP blocking.
Step 4: Check for Sanitization/Whitelist Mechanisms
Only basic sanitization is applied. No URL parsing or host whitelisting. Verdict: True Positive.
3. Proof of Exploit
3.1 DNSLOG Proof: Submit http://7fe813ca.log.dnslog.pp.ua as filename.
3.2 Netcat Listener: Submit http://127.0.0.1:9999, observe incoming connection.
3.3 Internal Service: Submit http://127.0.0.1:80 returns found XML; http://127.0.0.1:3306 returns “Can not found XML file”.
4. Conclusion
Confirmed SSRF in the Rhymix data import module. Requires authenticated administrator account (is_admin=Y), but enables internal network discovery, port scanning, and cloud metadata access.
Key Evidence:
• modules/importer/importer.admin.controller.php:38-65: @fopen($filename)
• modules/importer/tpl/js/importer_admin.js:10-72: raw admin input
• classes/context/Context.class.php:1247-1310: no sanitization
5. Remediation Recommendations
1. Enforce Strict Whitelisting using parse_url() before fopen().
2. Block private IP ranges after DNS resolution.
3. Prefer Rhymix’s built-in HTTP client over direct fopen().
6. Disclosure Notes
This report is submitted in accordance with Rhymix’s security policy. Previously reported via email to [email protected] on 2026-06-03. No response received after 12+ days. Full PoC and disclosure details are included in the Announcement section.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
This vulnerability was reported to [email protected] on 2026-06-03. No response received after 12 days. Full PoC and disclosure details are included in the Announcement section. |
|---|
| स्रोत | ⚠️ https://github.com/MCzhao2006/Rhymix-SSRF-Report |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 15/06/2026 05:43 AM (2 महीनों पहले) |
|---|
| संयम | 04/08/2026 05:59 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385868 [Poesis Rhymix CMS तक 2.1.33 Data Import importer.admin.controller.php procImporterAdminCheckXmlFile filename अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|