| タイトル | octobercms October CMS <= 4.3.4 Path Traversal |
|---|
| 説明 | A stream wrapper injection vulnerability exists in October CMS versions up to and including 4.3.4 (commit c1876c7). The System\Classes\ResizeImages class classifies external image sources using an incomplete prefix check — strpos($realSourcePath, 'http') === 0 — in getSourcePathForResize() (modules/system/classes/ResizeImages.php:191). As a result, PHP stream wrapper URIs with schemes other than http(s) (e.g., phar://, file://, ftp://) are treated as local paths, bypassing all SSRF protections (validateExternalImageUrl, validateExternalImageHost, validateImageContents).
When a phar:// URI reaches Resizer::open(), the Symfony File object and Intervention Image GD driver trigger PHP's PHAR stream wrapper, which deserializes the archive's metadata. A verified POP gadget chain exists in the dependency tree: GuzzleHttp\Cookie\FileCookieJar::__destruct() calls save($this->filename), which executes file_put_contents() with an attacker-controlled path and JSON content containing embedded PHP code (the SetCookie::validate() regex is bypassed during deserialization). This was confirmed by executing id, whoami, and uname -a in a PoC against October CMS v4.3.4's actual vendor/ tree. The GET /resize/{file} route (modules/system/routes.php:15) is publicly accessible without authentication, allowing unauthenticated visitors to trigger a cached malicious path. Other schemes enable blind SSRF (ftp://, gopher://) or arbitrary local file disclosure (file://).
The vulnerability requires an attacker to (1) influence an image path processed by ResizeImages::resize() (e.g., via the Twig |resize filter or MediaFinder widget) and (2) upload a PHAR-PNG polyglot file to a known server path. |
|---|
| ソース | ⚠️ https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md |
|---|
| ユーザー | chenhuanlin (UID 100424) |
|---|
| 送信 | 2026年08月10日 07:17 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 12:19 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410869 [OctoberCMS 迄 4.1.19/4.2.25/4.3.4 ResizeImages.php getSourcePathForResize realSourcePath 特権昇格] |
|---|
| ポイント | 20 |
|---|