提出 #858471: Poesis Inc. Rhymix CMS <=2.1.33 Server-Side Request Forgery

Security Vulnerability Report: SSRF in Rhymix Data Import Module

1. Summary
• Vulnerability Type: Server-Side Request Forgery (CWE-918)
• Affected File: modules/importer/importer.admin.controller.php (Lines 34–85)
• Vulnerability Description: The importer admin controller directly uses fopen() to fetch files via HTTP when the filename parameter starts with http://. Since there is no whitelist restriction on target hosts or IP addresses, an authenticated administrator can abuse this functionality to launch SSRF attacks against internal services.

2. Analysis Logic
Step 1: Examine the Sink at modules/importer/importer.admin.controller.php:34-85
$filename = Context::get('filename');
...
if(strncasecmp('http://', $filename, 7) === 0)
{
if(ini_get('allow_url_fopen'))
{
$fp = @fopen($filename, "r");
...
}
...
$this->add('exists', $isExists);
}
The controller code opens any URL starting with http:// via fopen() and checks if the resource exists. The only prerequisite is that allow_url_fopen is enabled. No host validation, IP address restriction, or port limitation is implemented, allowing access to internal endpoints such as cloud metadata services.

Step 2: Trace How filename is Supplied via Admin Interface
• JavaScript Binding (modules/importer/tpl/js/importer_admin.js:10-76):
$('.checkxml')...find('button').click(function(){
...
$.exec_json('importer.procImporterAdminCheckXmlFile', {filename:$.trim($input.val())}, on_complete);
});
• Action Registration (modules/importer/conf/module.xml:5-10):
<action name="procImporterAdminCheckXmlFile" type="controller" />
The admin interface binds a button click event to send arbitrary user input from the textbox as the filename parameter. This action is registered as a valid controller endpoint, meaning any authenticated administrator (is_admin=Y) can exploit this endpoint with attacker-specified URLs.

Step 3: Trace Request Data to Context::get()
• Request Handling (classes/context/Context.class.php:1247-1310 & 2001-2025): directly copies raw $_GET/$_POST into Context::$_user_vars and Context::get() returns it without URL sanitization.
• Filter Logic: Only basic escaping, no parse_url, no whitelist, no private IP blocking.

Step 4: Check for Sanitization/Whitelist Mechanisms
Only basic sanitization is applied. No URL parsing or host whitelisting. Verdict: True Positive.

3. Proof of Exploit
3.1 DNSLOG Proof: Submit http://7fe813ca.log.dnslog.pp.ua as filename.
3.2 Netcat Listener: Submit http://127.0.0.1:9999, observe incoming connection.
3.3 Internal Service: Submit http://127.0.0.1:80 returns found XML; http://127.0.0.1:3306 returns “Can not found XML file”.

4. Conclusion
Confirmed SSRF in the Rhymix data import module. Requires authenticated administrator account (is_admin=Y), but enables internal network discovery, port scanning, and cloud metadata access.

Key Evidence:
• modules/importer/importer.admin.controller.php:38-65: @fopen($filename)
• modules/importer/tpl/js/importer_admin.js:10-72: raw admin input
• classes/context/Context.class.php:1247-1310: no sanitization

5. Remediation Recommendations
1. Enforce Strict Whitelisting using parse_url() before fopen().
2. Block private IP ranges after DNS resolution.
3. Prefer Rhymix’s built-in HTTP client over direct fopen().

6. Disclosure Notes
This report is submitted in accordance with Rhymix’s security policy. Previously reported via email to [email protected] on 2026-06-03. No response received after 12+ days. Full PoC and disclosure details are included in the Announcement section.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

This vulnerability was reported to [email protected] on 2026-06-03. No response received after 12 days. Full PoC and disclosure details are included in the Announcement section.

• ソース: ⚠️ https://github.com/MCzhao2006/Rhymix-SSRF-Report
• ユーザー: Anonymous User
• 送信: 2026年06月15日 05:43 (2 月 ago)
• モデレーション: 2026年08月04日 17:59 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 385868 [Poesis Rhymix CMS 迄 2.1.33 Data Import importer.admin.controller.php procImporterAdminCheckXmlFile filename 特権昇格]
• ポイント: 20