CVE-2023-40033 (published 2023-08-16T21:15Z)

Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/flarum/framework
commit_details: repo_url: https://github.com/flarum/framework
author: Sami Mazouz
author_date: 2023-05-20 10:51:26+01:00
msg: fix: improve avatar upload functionality

Signed-off-by: Sami Mazouz <sychocouldy@gmail.com>
repository: repo_url: https://github.com/flarum/framework
repo_name: flarum/framework
description: Simple forum software for building great communities.
repo_language: PHP
owner: flarum
file_changes: filename: AvatarEditor.js
change_type: ModificationType.MODIFY
diff: @@ -204,7 +204,7 @@ export default class AvatarEditor extends Component {
 
   /**
    * After a successful upload/removal, push the updated user data into the
-   * store, and force a recomputation of the user's avatar color.
+   * store, and force a re-computation of the user's avatar color.
    *
    * @param {object} response
    * @protected

programming_language: TypeScript
filename: UploadFaviconController.php
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,7 @@ class UploadFaviconController extends UploadImageController
             ]);
         }
 
-        $encodedImage = $this->imageManager->make($file->getStream())->resize(64, 64, function ($constraint) {
+        $encodedImage = $this->imageManager->make($file->getStream()->getMetadata('uri'))->resize(64, 64, function ($constraint) {
             $constraint->aspectRatio();
             $constraint->upsize();
         })->encode('png');

programming_language: PHP
filename: UploadLogoController.php
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ class UploadLogoController extends UploadImageController
      */
     protected function makeImage(UploadedFileInterface $file): Image
     {
-        $encodedImage = $this->imageManager->make($file->getStream())->heighten(60, function ($constraint) {
+        $encodedImage = $this->imageManager->make($file->getStream()->getMetadata('uri'))->heighten(60, function ($constraint) {
             $constraint->upsize();
         })->encode('png');
 

programming_language: PHP
filename: AvatarValidator.php
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,7 @@ class AvatarValidator extends AbstractValidator
         }
 
         try {
-            $this->imageManager->make($file->getStream());
+            $this->imageManager->make($file->getStream()->getMetadata('uri'));
         } catch (NotReadableException $_e) {
             $this->raise('image');
         }

programming_language: PHP
filename: UploadAvatarHandler.php
change_type: ModificationType.MODIFY
diff: @@ -74,7 +74,7 @@ class UploadAvatarHandler
 
         $this->validator->assertValid(['avatar' => $command->file]);
 
-        $image = $this->imageManager->make($command->file->getStream());
+        $image = $this->imageManager->make($command->file->getStream()->getMetadata('uri'));
 
         $this->events->dispatch(
             new AvatarSaving($user, $actor, $image)

programming_language: PHP