Summary
Leantime 3.6.2 contains a server-side request forgery and local file inclusion flaw in its blueprint import functionality, where user-supplied filenames are passed directly to file_get_contents() without validation.
Authenticated attackers can abuse URL wrappers or path traversal sequences via the JSON-RPC API to coerce the server into contacting internal services or reading arbitrary local files, becoming dangerous wherever internal network access or sensitive filesystem data is present.
Leantime 3.6.2 contains a server-side request forgery and local file inclusion flaw in its blueprint import functionality, where user-supplied filenames are passed directly to file_get_contents() without validation.
Authenticated attackers can abuse URL wrappers or path traversal sequences via the JSON-RPC API to coerce the server into contacting internal services or reading arbitrary local files, becoming dangerous wherever internal network access or sensitive filesystem data is present.
Affected context
This vulnerability arises in Leantime installations that expose the Blueprints::import() functionality through the JSON-RPC API to authenticated users.
The issue is relevant when the application:
- Runs with network connectivity to internal services, cloud metadata endpoints, or other protected resources
- Has filesystem access to sensitive configuration, credential, or log files
- Accepts user-controlled filename parameters without enforcing strict path or scheme validation
In such environments, an attacker's crafted filename can redirect requests to internal URLs or traverse directories on the local server.
This vulnerability arises in Leantime installations that expose the Blueprints::import() functionality through the JSON-RPC API to authenticated users.
The issue is relevant when the application:
- Runs with network connectivity to internal services, cloud metadata endpoints, or other protected resources
- Has filesystem access to sensitive configuration, credential, or log files
- Accepts user-controlled filename parameters without enforcing strict path or scheme validation
In such environments, an attacker's crafted filename can redirect requests to internal URLs or traverse directories on the local server.
Exploit preconditions
- Attack surface: JSON-RPC API endpoint that accepts blueprint import requests
- Required access: Valid authenticated user account with permission to invoke Blueprints::import()
- Trigger point: Submission of a crafted filename parameter containing URL wrappers (e.g., HTTP streams) or path traversal sequences
- Why exploitation is possible: The import method passes the supplied filename directly to file_get_contents() without normalizing paths, restricting schemes, or enforcing an allowlist, enabling both SSRF and arbitrary file reads.
- Attack surface: JSON-RPC API endpoint that accepts blueprint import requests
- Required access: Valid authenticated user account with permission to invoke Blueprints::import()
- Trigger point: Submission of a crafted filename parameter containing URL wrappers (e.g., HTTP streams) or path traversal sequences
- Why exploitation is possible: The import method passes the supplied filename directly to file_get_contents() without normalizing paths, restricting schemes, or enforcing an allowlist, enabling both SSRF and arbitrary file reads.
Why this happens
The core issue is trusting user-controlled input as a direct source for server-side file and resource access.
In the affected code path, the Blueprints::import() method uses file_get_contents() on a filename value derived from JSON-RPC request parameters. Because this filename is neither sanitized nor constrained to a safe directory or scheme, attackers can:
- Reference external or internal URLs via PHP stream wrappers, causing the application server to perform HTTP requests on their behalf (SSRF, CWE-918).
- Use relative path traversal (e.g., "../") to escape intended directories and read arbitrary files from the filesystem (a local file inclusion / path traversal pattern).
Abstractly, this maps to the bug class of server-side resource access with unvalidated user input, where APIs assume filenames or URLs are benign and fail to enforce strict boundaries on what the server may reach.
The core issue is trusting user-controlled input as a direct source for server-side file and resource access.
In the affected code path, the Blueprints::import() method uses file_get_contents() on a filename value derived from JSON-RPC request parameters. Because this filename is neither sanitized nor constrained to a safe directory or scheme, attackers can:
- Reference external or internal URLs via PHP stream wrappers, causing the application server to perform HTTP requests on their behalf (SSRF, CWE-918).
- Use relative path traversal (e.g., "../") to escape intended directories and read arbitrary files from the filesystem (a local file inclusion / path traversal pattern).
Abstractly, this maps to the bug class of server-side resource access with unvalidated user input, where APIs assume filenames or URLs are benign and fail to enforce strict boundaries on what the server may reach.
Potential impact
- Authenticated attackers may read cloud instance metadata (e.g., IAM role credentials, tokens).
- Attackers could access internal HTTP services not exposed externally, such as admin panels or management APIs.
- Sensitive local files, including configuration files, API keys, or database credentials, can be retrieved from the server.
- Application secrets revealed via SSRF or file reads may enable broader account compromise or lateral movement.
- Exposure of log files and source code may aid in discovering further exploitable vulnerabilities.
- Authenticated attackers may read cloud instance metadata (e.g., IAM role credentials, tokens).
- Attackers could access internal HTTP services not exposed externally, such as admin panels or management APIs.
- Sensitive local files, including configuration files, API keys, or database credentials, can be retrieved from the server.
- Application secrets revealed via SSRF or file reads may enable broader account compromise or lateral movement.
- Exposure of log files and source code may aid in discovering further exploitable vulnerabilities.
General mitigation guidance
Effective mitigation focuses on strictly constraining how the server interprets user-provided filenames and URLs and on reducing the trust placed in internal network and filesystem resources.
Recommended design patterns include:
- Restricting blueprints import to a predefined set of locations or identifiers rather than raw paths, using an internal lookup table or ID-based references.
- Enforcing an allowlist of acceptable schemes (e.g., "file" only) and rejecting all URL wrappers or non-local streams.
- Normalizing and validating paths to ensure they stay within a designated application directory, disabling relative traversal outside that root.
- Separating privileges so that the application process has minimal access to sensitive files and limited ability to reach critical internal services.
- Implementing defense-in-depth controls such as network egress filtering and metadata service protection at the infrastructure layer, so that mistakes in application-level validation are less damaging.
Effective mitigation focuses on strictly constraining how the server interprets user-provided filenames and URLs and on reducing the trust placed in internal network and filesystem resources.
Recommended design patterns include:
- Restricting blueprints import to a predefined set of locations or identifiers rather than raw paths, using an internal lookup table or ID-based references.
- Enforcing an allowlist of acceptable schemes (e.g., "file" only) and rejecting all URL wrappers or non-local streams.
- Normalizing and validating paths to ensure they stay within a designated application directory, disabling relative traversal outside that root.
- Separating privileges so that the application process has minimal access to sensitive files and limited ability to reach critical internal services.
- Implementing defense-in-depth controls such as network egress filtering and metadata service protection at the infrastructure layer, so that mistakes in application-level validation are less damaging.
How teams detect issues like this
Organizations can detect and monitor this class of vulnerability using a mix of preventive and detective techniques:
- Static analysis rules targeting calls like file_get_contents(), fopen(), or cURL functions when they consume unvalidated request parameters, especially in import or upload flows.
- Code review checklists that flag direct use of user-supplied paths or URLs, requiring reviewers to confirm allowlists, path normalization, and scheme restrictions.
- Security policies that mandate central utility functions for resource fetching which encapsulate validation logic, and discourage ad hoc usage of low-level file and HTTP APIs.
- Runtime monitoring and logging of outbound HTTP requests from the application layer, with alerts for unusual destinations such as metadata services or non-standard internal hosts.
- Use of automated SAST/DAST tools configured to recognize SSRF patterns, directory traversal indicators, and unsafe file inclusion behaviors in PHP applications.
Organizations can detect and monitor this class of vulnerability using a mix of preventive and detective techniques:
- Static analysis rules targeting calls like file_get_contents(), fopen(), or cURL functions when they consume unvalidated request parameters, especially in import or upload flows.
- Code review checklists that flag direct use of user-supplied paths or URLs, requiring reviewers to confirm allowlists, path normalization, and scheme restrictions.
- Security policies that mandate central utility functions for resource fetching which encapsulate validation logic, and discourage ad hoc usage of low-level file and HTTP APIs.
- Runtime monitoring and logging of outbound HTTP requests from the application layer, with alerts for unusual destinations such as metadata services or non-standard internal hosts.
- Use of automated SAST/DAST tools configured to recognize SSRF patterns, directory traversal indicators, and unsafe file inclusion behaviors in PHP applications.
