| 标题 | octobercms October CMS <= 4.3.4 Path Traversal |
|---|
| 描述 | A stream wrapper injection vulnerability exists in October CMS versions up to and including 4.3.4 (commit c1876c7). The System\Classes\ResizeImages class classifies external image sources using an incomplete prefix check — strpos($realSourcePath, 'http') === 0 — in getSourcePathForResize() (modules/system/classes/ResizeImages.php:191). As a result, PHP stream wrapper URIs with schemes other than http(s) (e.g., phar://, file://, ftp://) are treated as local paths, bypassing all SSRF protections (validateExternalImageUrl, validateExternalImageHost, validateImageContents).
When a phar:// URI reaches Resizer::open(), the Symfony File object and Intervention Image GD driver trigger PHP's PHAR stream wrapper, which deserializes the archive's metadata. A verified POP gadget chain exists in the dependency tree: GuzzleHttp\Cookie\FileCookieJar::__destruct() calls save($this->filename), which executes file_put_contents() with an attacker-controlled path and JSON content containing embedded PHP code (the SetCookie::validate() regex is bypassed during deserialization). This was confirmed by executing id, whoami, and uname -a in a PoC against October CMS v4.3.4's actual vendor/ tree. The GET /resize/{file} route (modules/system/routes.php:15) is publicly accessible without authentication, allowing unauthenticated visitors to trigger a cached malicious path. Other schemes enable blind SSRF (ftp://, gopher://) or arbitrary local file disclosure (file://).
The vulnerability requires an attacker to (1) influence an image path processed by ResizeImages::resize() (e.g., via the Twig |resize filter or MediaFinder widget) and (2) upload a PHAR-PNG polyglot file to a known server path. |
|---|
| 来源 | ⚠️ https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md |
|---|
| 用户 | chenhuanlin (UID 100424) |
|---|
| 提交 | 2026-08-10 07時17分 (2 月前) |
|---|
| 管理 | 2026-09-27 12時19分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410869 [OctoberCMS 直到 4.1.19/4.2.25/4.3.4 ResizeImages.php getSourcePathForResize realSourcePath 权限提升] |
|---|
| 积分 | 20 |
|---|