CVE-2023-46236: Server-Side Request Forgery (SSRF) (CWE-918)
value: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2023-10-31T15:15Z
Repository: https://github.com/FOGProject/fogproject
Language: PHP
Files changed: packages/web/service/getversion.php, packages/web/status/kernelvers.php
Commit date: 2023-01-28 23:52:14 +0100
Commit message: [getversion/kernelvers] Prevent unauthenticated clients from making arbitrary requests, thanks @0x41c


Diff: diff --git a/packages/web/service/getversion.php b/packages/web/service/getversion.php
index 1dc9e574d..3e4f0989b 100644
--- a/packages/web/service/getversion.php
+++ b/packages/web/service/getversion.php
@@ -26,28 +26,38 @@
  * @author   Tom Elliott <tommygunsster@gmail.com>
  * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
  * @link     https://fogproject.org
  */
 require '../commons/base.inc.php';
-$clientUpdate = (bool)FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
+$clientUpdate = (bool) FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
 if (isset($_REQUEST['client'])) {
     $ver = (
-        $clientUpdate ?
+        $clientUpdate ? 
         '9.9.99' :
         '0.0.0'
     );
 } elseif (isset($_REQUEST['clientver'])) {
     $ver = (
-        $clientUpdate ?
+        $clientUpdate ? 
         FOG_CLIENT_VERSION :
         '0.0.0'
     );
 } elseif (isset($_REQUEST['url'])) {
+
+    // Prevent an unauthenticated user from making arbitrary requests.
+    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
+        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';
+
+    if ($unauthorized) {
+        echo _('Unauthorized');
+        exit;
+    }
+
     $url = $_REQUEST['url'];
     $res = $FOGURLRequests
         ->process($_REQUEST['url']);
     $ver = array_shift($res);
 } else {
     $ver = FOG_VERSION;
 }
 echo $ver;
-exit;
+exit;
\ No newline at end of file
diff --git a/packages/web/status/kernelvers.php b/packages/web/status/kernelvers.php
index d39cdea3c..3aedc101d 100644
--- a/packages/web/status/kernelvers.php
+++ b/packages/web/status/kernelvers.php
@@ -22,20 +22,32 @@
 require '../commons/base.inc.php';
 session_write_close();
 ignore_user_abort(true);
 set_time_limit(0);
 header('Content-Type: text/event-stream');
-$url = filter_input(INPUT_POST, 'url');
-if ($url) {
+
+if (isset($_POST['url'])) {
+
+    // Prevent an unauthenticated user from making arbitrary requests.
+    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
+        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';
+
+    if ($unauthorized) {
+        echo _('Unauthorized');
+        exit;
+    }
+
     $res = $FOGURLRequests
-        ->process($url);
-    foreach ((array)$res as &$response) {
+        ->process(filter_input(INPUT_POST, 'url'));
+    foreach ((array) $res as &$response) {
         echo $response;
         unset($response);
     }
+    
     exit;
 }
+
 $kernelvers = function ($kernel) {
     $currpath = sprintf(
         '%s%sservice%sipxe%s%s',
         BASEPATH,
         DS,
@@ -55,11 +67,11 @@ printf(
     "%s\n",
     FOG_VERSION
 );
 printf(
     "bzImage Version: %s\n",
-    $kernelvers('bzImage')
+        $kernelvers('bzImage')
 );
 printf(
     "bzImage32 Version: %s",
-    $kernelvers('bzImage32')
-);
+        $kernelvers('bzImage32')
+);
\ No newline at end of file

Vulnerable code: $clientUpdate = (bool)FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
        $clientUpdate ?
        $clientUpdate ?
exit;
$url = filter_input(INPUT_POST, 'url');
if ($url) {
        ->process($url);
    foreach ((array)$res as &$response) {
    $kernelvers('bzImage')
    $kernelvers('bzImage32')
);
Fixed code: $clientUpdate = (bool) FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
        $clientUpdate ? 
        $clientUpdate ? 

    // Prevent an unauthenticated user from making arbitrary requests.
    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

    if ($unauthorized) {
        echo _('Unauthorized');
        exit;
    }

exit;

if (isset($_POST['url'])) {

    // Prevent an unauthenticated user from making arbitrary requests.
    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

    if ($unauthorized) {
        echo _('Unauthorized');
        exit;
    }

        ->process(filter_input(INPUT_POST, 'url'));
    foreach ((array) $res as &$response) {
    

        $kernelvers('bzImage')
        $kernelvers('bzImage32')
);