Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API

Full Disclosure ()1 · 1 read
Read at seclists.org
Part of a story covered by 8 sourcesFlextype CMS v1.0.0-alpha.3: Eight Disclosed Vulnerabilities Enable Auth Bypass, File Read, SSRF, and PHP Remote Code ExecutionMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

Flextype CMS v1.0.0-alpha.3 exposes an SSRF flaw in its /api/v1/query endpoint, letting authenticated users make the server send arbitrary HTTP requests.

Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery vulnerability in the expression-processing functionality of the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch() function, causing the server to issue outbound HTTP requests. The application does not sufficiently restrict destination hosts, enabling requests to attacker-controlled or internal targets.

Key facts
  • Authenticated attackers can pass arbitrary URLs to the exposed fetch() function
  • Insufficient destination restrictions allow outbound requests to attacker-controlled hosts
  • Affected software is Flextype CMS v1.0.0-alpha.3; no CVE cited in the disclosure
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
cmsflextypequery-apiserver-side-request-forgeryssrf
Vendors
Flextype
Products
Flextype CMS

From the original article

Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.