| Titolo | octobercms October CMS <= 4.3.4 Path Traversal |
|---|
| Descrizione | A stream wrapper injection vulnerability exists in October CMS versions up to and including 4.3.4 (commit c1876c7). The System\Classes\ResizeImages class classifies external image sources using an incomplete prefix check — strpos($realSourcePath, 'http') === 0 — in getSourcePathForResize() (modules/system/classes/ResizeImages.php:191). As a result, PHP stream wrapper URIs with schemes other than http(s) (e.g., phar://, file://, ftp://) are treated as local paths, bypassing all SSRF protections (validateExternalImageUrl, validateExternalImageHost, validateImageContents).
When a phar:// URI reaches Resizer::open(), the Symfony File object and Intervention Image GD driver trigger PHP's PHAR stream wrapper, which deserializes the archive's metadata. A verified POP gadget chain exists in the dependency tree: GuzzleHttp\Cookie\FileCookieJar::__destruct() calls save($this->filename), which executes file_put_contents() with an attacker-controlled path and JSON content containing embedded PHP code (the SetCookie::validate() regex is bypassed during deserialization). This was confirmed by executing id, whoami, and uname -a in a PoC against October CMS v4.3.4's actual vendor/ tree. The GET /resize/{file} route (modules/system/routes.php:15) is publicly accessible without authentication, allowing unauthenticated visitors to trigger a cached malicious path. Other schemes enable blind SSRF (ftp://, gopher://) or arbitrary local file disclosure (file://).
The vulnerability requires an attacker to (1) influence an image path processed by ResizeImages::resize() (e.g., via the Twig |resize filter or MediaFinder widget) and (2) upload a PHAR-PNG polyglot file to a known server path. |
|---|
| Fonte | ⚠️ https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md |
|---|
| Utente | chenhuanlin (UID 100424) |
|---|
| Sottomissione | 10/08/2026 07:17 (2 mesi fa) |
|---|
| Moderazione | 27/09/2026 12:19 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 410869 [OctoberCMS fino a 4.1.19/4.2.25/4.3.4 ResizeImages.php getSourcePathForResize realSourcePath escalationi di privilegi] |
|---|
| Punti | 20 |
|---|