Summary
Malcolm's file-upload component includes an upstream FilePond PHP endpoint that can make server-side requests to attacker-selected URLs. When the endpoint is reachable and the request is processed, an attacker may retrieve internal or otherwise protected content through the upload service.
Malcolm's file-upload component includes an upstream FilePond PHP endpoint that can make server-side requests to attacker-selected URLs. When the endpoint is reachable and the request is processed, an attacker may retrieve internal or otherwise protected content through the upload service.
Affected context
The issue occurs in Malcolm deployments that use the FilePond PHP server component with the upstream fetch route available. Risk increases when the endpoint accepts attacker-controlled URLs, permits redirects, and can store fetched response content in the transfer directory for later retrieval. The practical impact depends on network reachability, authentication controls, and the permissions available to the upload container.
The issue occurs in Malcolm deployments that use the FilePond PHP server component with the upstream fetch route available. Risk increases when the endpoint accepts attacker-controlled URLs, permits redirects, and can store fetched response content in the transfer directory for later retrieval. The practical impact depends on network reachability, authentication controls, and the permissions available to the upload container.
Exploit preconditions
- Attack surface: The FilePond PHP file-upload HTTP endpoint and its fetch route
- Required access: Ability to submit requests to the exposed upload service; authentication requirements depend on deployment configuration
- Trigger point: Processing a fetch request containing an attacker-influenced URL
- Why exploitation is possible: The server performs outbound URL retrieval with redirect following enabled and may persist the response body in the transfer directory, allowing the caller to obtain the resulting transfer reference and fetched content
- Attack surface: The FilePond PHP file-upload HTTP endpoint and its fetch route
- Required access: Ability to submit requests to the exposed upload service; authentication requirements depend on deployment configuration
- Trigger point: Processing a fetch request containing an attacker-influenced URL
- Why exploitation is possible: The server performs outbound URL retrieval with redirect following enabled and may persist the response body in the transfer directory, allowing the caller to obtain the resulting transfer reference and fetched content
Why this happens
The underlying bug is server-side request forgery, mapped to CWE-918. A server-side fetch API accepts a URL from an insufficiently trusted request and uses the upload service's network position and privileges to retrieve it. Redirect following and response persistence increase the risk because the initial destination may lead to additional internal or protected resources whose content can become available through the application.
The underlying bug is server-side request forgery, mapped to CWE-918. A server-side fetch API accepts a URL from an insufficiently trusted request and uses the upload service's network position and privileges to retrieve it. Redirect following and response persistence increase the risk because the initial destination may lead to additional internal or protected resources whose content can become available through the application.
Potential impact
- An attacker may access cloud instance metadata or internal service endpoints
- Sensitive responses may be disclosed through the upload transfer mechanism
- Internal network topology and service behavior could be enumerated
- The upload container may be used to reach systems unavailable to external clients
- Requests could cause unintended actions against reachable internal services
- An attacker may access cloud instance metadata or internal service endpoints
- Sensitive responses may be disclosed through the upload transfer mechanism
- Internal network topology and service behavior could be enumerated
- The upload container may be used to reach systems unavailable to external clients
- Requests could cause unintended actions against reachable internal services
General mitigation guidance
Mitigation generally focuses on removing unnecessary server-side fetching and reducing trust in user-supplied destinations.
Common defensive patterns include:
- Restricting outbound requests to an explicit, minimal allowlist of approved schemes, hosts, ports, and destinations
- Blocking loopback, link-local, private, reserved, and container-network address ranges after DNS resolution
- Revalidating destinations after redirects and disabling redirect following unless it is required
- Avoiding persistence or direct readback of fetched response bodies when the feature does not require it
- Applying network egress policies so the upload container cannot reach sensitive control-plane or metadata services
- Running the component with least-privilege filesystem and network permissions
- Enforcing authentication, authorization, request limits, and response-size limits around fetch functionality
Mitigation generally focuses on removing unnecessary server-side fetching and reducing trust in user-supplied destinations.
Common defensive patterns include:
- Restricting outbound requests to an explicit, minimal allowlist of approved schemes, hosts, ports, and destinations
- Blocking loopback, link-local, private, reserved, and container-network address ranges after DNS resolution
- Revalidating destinations after redirects and disabling redirect following unless it is required
- Avoiding persistence or direct readback of fetched response bodies when the feature does not require it
- Applying network egress policies so the upload container cannot reach sensitive control-plane or metadata services
- Running the component with least-privilege filesystem and network permissions
- Enforcing authentication, authorization, request limits, and response-size limits around fetch functionality
How teams detect issues like this
Detection approaches can include:
- Static analysis for HTTP clients invoked with request-derived URLs
- Code review checks for URL validation, redirect handling, DNS rebinding exposure, and response persistence
- Dynamic testing with controlled internal, loopback, redirect, and non-HTTP destinations
- Egress monitoring for unexpected connections from the upload container to private ranges or metadata endpoints
- Web application logs correlating fetch requests, destination URLs, redirect chains, transfer identifiers, and response retrievals
- Policy enforcement that blocks unrestricted outbound network access from file-processing workloads
Detection approaches can include:
- Static analysis for HTTP clients invoked with request-derived URLs
- Code review checks for URL validation, redirect handling, DNS rebinding exposure, and response persistence
- Dynamic testing with controlled internal, loopback, redirect, and non-HTTP destinations
- Egress monitoring for unexpected connections from the upload container to private ranges or metadata endpoints
- Web application logs correlating fetch requests, destination URLs, redirect chains, transfer identifiers, and response retrievals
- Policy enforcement that blocks unrestricted outbound network access from file-processing workloads
