제출 #919993: octobercms October CMS <= 4.3.4 Path Traversal

A stream wrapper injection vulnerability exists in October CMS versions up to and including 4.3.4 (commit c1876c7). The System\Classes\ResizeImages class classifies external image sources using an incomplete prefix check — strpos($realSourcePath, 'http') === 0 — in getSourcePathForResize() (modules/system/classes/ResizeImages.php:191). As a result, PHP stream wrapper URIs with schemes other than http(s) (e.g., phar://, file://, ftp://) are treated as local paths, bypassing all SSRF protections (validateExternalImageUrl, validateExternalImageHost, validateImageContents).

When a phar:// URI reaches Resizer::open(), the Symfony File object and Intervention Image GD driver trigger PHP's PHAR stream wrapper, which deserializes the archive's metadata. A verified POP gadget chain exists in the dependency tree: GuzzleHttp\Cookie\FileCookieJar::__destruct() calls save($this->filename), which executes file_put_contents() with an attacker-controlled path and JSON content containing embedded PHP code (the SetCookie::validate() regex is bypassed during deserialization). This was confirmed by executing id, whoami, and uname -a in a PoC against October CMS v4.3.4's actual vendor/ tree. The GET /resize/{file} route (modules/system/routes.php:15) is publicly accessible without authentication, allowing unauthenticated visitors to trigger a cached malicious path. Other schemes enable blind SSRF (ftp://, gopher://) or arbitrary local file disclosure (file://).

The vulnerability requires an attacker to (1) influence an image path processed by ResizeImages::resize() (e.g., via the Twig |resize filter or MediaFinder widget) and (2) upload a PHAR-PNG polyglot file to a known server path.

• 원천: ⚠️ https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md
• 사용자: chenhuanlin (UID 100424)
• 제출: 2026. 08. 10. AM 07:17 (2 개월 ago)
• 모더레이션: 2026. 09. 27. PM 12:19 (2 months later)
• 상태: 수락
• VulDB 항목: 410869 [OctoberCMS 까지 4.1.19/4.2.25/4.3.4 ResizeImages.php getSourcePathForResize realSourcePath 권한 상승]
• 포인트들: 20