Skip to content

FeehiCMS UEditor catchImage Server-Side Request Forgery (SSRF) #95

Description

@yang5ynag

FeehiCMS 2.1.1 includes a UEditor widget with a catchImage action that fetches remote images. The IP address validation in saveRemote() (backend/widgets/ueditor/Uploader.php, line 235) uses PHP's FILTER_FLAG_NO_PRIV_RANGE filter, which only blocks private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but does not filter loopback addresses (127.0.0.0/8) or link-local addresses (169.254.0.0/16).

Combined with the assets/* whitelist (see FEHI-001), an unauthenticated attacker can send HTTP requests to the server's loopback interface, perform internal port scanning, access internal services, and potentially reach cloud metadata endpoints.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions