Summary
Feehi CMS 2.1.1 contains a server-side request forgery vulnerability in the UEditor catchimage endpoint. An attacker may cause the server to send HTTP requests to internal services when private-IP validation fails to reject loopback or link-local addresses, with response differences potentially revealing service behavior.
Feehi CMS 2.1.1 contains a server-side request forgery vulnerability in the UEditor catchimage endpoint. An attacker may cause the server to send HTTP requests to internal services when private-IP validation fails to reject loopback or link-local addresses, with response differences potentially revealing service behavior.
Affected context
The issue occurs in deployments that expose the UEditor catchimage endpoint and use server-side fetching for supplied image locations. Risk increases when the endpoint accepts attacker-influenced URLs, relies on incomplete private-address validation, and can reach loopback, link-local, or other internal network destinations.
The issue occurs in deployments that expose the UEditor catchimage endpoint and use server-side fetching for supplied image locations. Risk increases when the endpoint accepts attacker-influenced URLs, relies on incomplete private-address validation, and can reach loopback, link-local, or other internal network destinations.
Exploit preconditions
- Attack surface: The UEditor catchimage HTTP endpoint
- Required access: Ability to submit or influence a remote image URL, subject to the application's endpoint access controls
- Trigger point: Server-side retrieval of the supplied URL
- Why exploitation is possible: Address validation does not adequately block loopback and link-local destinations, allowing the server to probe internal HTTP services and expose response differences
- Attack surface: The UEditor catchimage HTTP endpoint
- Required access: Ability to submit or influence a remote image URL, subject to the application's endpoint access controls
- Trigger point: Server-side retrieval of the supplied URL
- Why exploitation is possible: Address validation does not adequately block loopback and link-local destinations, allowing the server to probe internal HTTP services and expose response differences
Why this happens
The vulnerability results from incomplete validation of destinations used for server-side HTTP requests. The application treats attacker-controlled URLs as fetchable without comprehensively rejecting loopback and link-local address ranges, allowing requests to cross the intended trust boundary. This maps to CWE-918: Server-Side Request Forgery, where a server is induced to communicate with unintended internal or restricted resources.
The vulnerability results from incomplete validation of destinations used for server-side HTTP requests. The application treats attacker-controlled URLs as fetchable without comprehensively rejecting loopback and link-local address ranges, allowing requests to cross the intended trust boundary. This maps to CWE-918: Server-Side Request Forgery, where a server is induced to communicate with unintended internal or restricted resources.
Potential impact
- Internal HTTP services may be probed from the application environment
- Response differences could disclose whether internal services or ports are reachable
- Network topology and service behavior may be inferred
- Access to internal endpoints could enable further attacks if those services trust the application
- Cloud or host metadata exposure may be possible where reachable and insufficiently protected
- Internal HTTP services may be probed from the application environment
- Response differences could disclose whether internal services or ports are reachable
- Network topology and service behavior may be inferred
- Access to internal endpoints could enable further attacks if those services trust the application
- Cloud or host metadata exposure may be possible where reachable and insufficiently protected
General mitigation guidance
Mitigation generally focuses on reducing trust in user-supplied destinations and enforcing comprehensive outbound request controls.
Common defensive patterns include:
- Restricting server-side fetching to approved schemes, hosts, and destinations
- Validating resolved IP addresses, including loopback, link-local, private, multicast, and reserved ranges
- Rechecking destinations after DNS resolution and across redirects
- Applying network egress policies that limit application access to internal services
- Avoiding detailed response differences and error messages for blocked or failed requests
- Running the fetching component with minimal network and operating-system privileges
Mitigation generally focuses on reducing trust in user-supplied destinations and enforcing comprehensive outbound request controls.
Common defensive patterns include:
- Restricting server-side fetching to approved schemes, hosts, and destinations
- Validating resolved IP addresses, including loopback, link-local, private, multicast, and reserved ranges
- Rechecking destinations after DNS resolution and across redirects
- Applying network egress policies that limit application access to internal services
- Avoiding detailed response differences and error messages for blocked or failed requests
- Running the fetching component with minimal network and operating-system privileges
How teams detect issues like this
Organizations can identify SSRF risks through:
- Static analysis of URL-fetching code that consumes request parameters
- Code review checks for incomplete private-address or hostname validation
- Tests covering loopback, link-local, private, reserved, redirect, and DNS-rebinding scenarios
- Network monitoring for unexpected outbound requests to internal address ranges
- Policy enforcement requiring allowlisted destinations and restricted egress for server-side fetchers
Automated security review tools may help flag request handlers that pass user-controlled URLs into HTTP clients without strong destination controls.
Organizations can identify SSRF risks through:
- Static analysis of URL-fetching code that consumes request parameters
- Code review checks for incomplete private-address or hostname validation
- Tests covering loopback, link-local, private, reserved, redirect, and DNS-rebinding scenarios
- Network monitoring for unexpected outbound requests to internal address ranges
- Policy enforcement requiring allowlisted destinations and restricted egress for server-side fetchers
Automated security review tools may help flag request handlers that pass user-controlled URLs into HTTP clients without strong destination controls.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
