Server-Side Request Forgery via Avatar upload in flarum

CVE-2023-40033

What is CVE-2023-40033?

Flarum forum software has a vulnerability that allows an attacker with a basic user account to execute a Blind Server-Side Request Forgery (SSRF) attack or disclose sensitive files on the server. This occurs by uploading a manipulated file that contains a URL, enabling the attacker to exploit the behavior of the 'intervention/image' package. This package interprets the provided file contents as a URL, fetching and exposing unintended content. Users are urged to upgrade to Flarum version 1.8.0 to mitigate this issue. For those unable to immediately upgrade, disabling PHP's 'allow_url_fopen' setting offers a temporary solution to restrict SSRF attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References