GHSA-67c6-q4j4-hccghigh7.1

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

The advisory, in context

Impact

The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the intervention/image package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack.

Patches

This has been patched in Flarum v1.8.

Workarounds

As a temporary workaround for the SSRF aspect of the vulnerability, one can disable PHP's allow_url_fopen which will prevent the fetching of external files via URLs.

Credits

Adam Kues - Assetnote

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

flarum/core Packagist

Ecosystem versions

Earlier releases before 1.8.0

Fixed in 1.8.0

43 explicitly affected versions

v0.1.0-beta, v0.1.0-beta.10, v0.1.0-beta.11, v0.1.0-beta.11.1, v0.1.0-beta.12, v0.1.0-beta.13, v0.1.0-beta.14, v0.1.0-beta.14.1, v0.1.0-beta.15, v0.1.0-beta.16, v0.1.0-beta.2, v0.1.0-beta.3, v0.1.0-beta.4, v0.1.0-beta.5, v0.1.0-beta.6, v0.1.0-beta.7, v0.1.0-beta.7.1, v0.1.0-beta.7.2, v0.1.0-beta.8, v0.1.0-beta.8.1, v0.1.0-beta.8.2, v0.1.0-beta.9, v1.0.0, v1.0.1, v1.0.2, v1.0.3, v1.0.4, v1.1.0, v1.1.1, v1.2.0, v1.2.1, v1.3.0, v1.3.1, v1.4.0, v1.4.1, v1.5.0, v1.6.0, v1.6.1, v1.6.2, v1.6.3, v1.7.0, v1.7.1, v1.7.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.8.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v0.1.0-beta",
    "v0.1.0-beta.10",
    "v0.1.0-beta.11",
    "v0.1.0-beta.11.1",
    "v0.1.0-beta.12",
    "v0.1.0-beta.13",
    "v0.1.0-beta.14",
    "v0.1.0-beta.14.1",
    "v0.1.0-beta.15",
    "v0.1.0-beta.16",
    "v0.1.0-beta.2",
    "v0.1.0-beta.3",
    "v0.1.0-beta.4",
    "v0.1.0-beta.5",
    "v0.1.0-beta.6",
    "v0.1.0-beta.7",
    "v0.1.0-beta.7.1",
    "v0.1.0-beta.7.2",
    "v0.1.0-beta.8",
    "v0.1.0-beta.8.1",
    "v0.1.0-beta.8.2",
    "v0.1.0-beta.9",
    "v1.0.0",
    "v1.0.1",
    "v1.0.2",
    "v1.0.3",
    "v1.0.4",
    "v1.1.0",
    "v1.1.1",
    "v1.2.0",
    "v1.2.1",
    "v1.3.0",
    "v1.3.1",
    "v1.4.0",
    "v1.4.1",
    "v1.5.0",
    "v1.6.0",
    "v1.6.1",
    "v1.6.2",
    "v1.6.3",
    "v1.7.0",
    "v1.7.1",
    "v1.7.2"
  ]
}

flarum/framework Packagist

Ecosystem versions

Earlier releases before 1.8.0

Fixed in 1.8.0

41 explicitly affected versions

v0.1.0-beta, v0.1.0-beta.10, v0.1.0-beta.11, v0.1.0-beta.11.1, v0.1.0-beta.12, v0.1.0-beta.13, v0.1.0-beta.14, v0.1.0-beta.14.1, v0.1.0-beta.15, v0.1.0-beta.16, v0.1.0-beta.2, v0.1.0-beta.3, v0.1.0-beta.4, v0.1.0-beta.5, v0.1.0-beta.6, v0.1.0-beta.7, v0.1.0-beta.7.1, v0.1.0-beta.7.2, v0.1.0-beta.8, v0.1.0-beta.8.1, v0.1.0-beta.8.2, v0.1.0-beta.9, v1.0.0, v1.0.1, v1.0.2, v1.0.3, v1.0.4, v1.1.0, v1.1.1, v1.2.0, v1.2.1, v1.3.0, v1.3.1, v1.4.0, v1.5.0, v1.6.0, v1.6.1, v1.6.2, v1.6.3, v1.7.0, v1.7.1