Server-Side Request Forgery via Avatar upload in flarum
CVE-2023-40033

7.1HIGH

Key Information:

Vendor

Flarum

Status
Framework
Vendor
CVE Published:
16 August 2023

What is CVE-2023-40033?

Flarum forum software has a vulnerability that allows an attacker with a basic user account to execute a Blind Server-Side Request Forgery (SSRF) attack or disclose sensitive files on the server. This occurs by uploading a manipulated file that contains a URL, enabling the attacker to exploit the behavior of the 'intervention/image' package. This package interprets the provided file contents as a URL, fetching and exposing unintended content. Users are urged to upgrade to Flarum version 1.8.0 to mitigate this issue. For those unable to immediately upgrade, disabling PHP's 'allow_url_fopen' setting offers a temporary solution to restrict SSRF attacks.

Affected Version(s)

framework < 1.8.0

References

https://github.com/flarum/framework/security/advisories/G...
x_refsource_CONFIRM
https://github.com/flarum/framework/commit/d1059c1cc79fe6...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.