CVE-2023-40033: Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Summary
CVE-2023-40033: Flarum vulnerable to LFI and Blind SSRF via Avatar upload. Affects flarum/core versions < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flarum is a forum software that allows users to create and manage online discussion forums. It is widely used for community engagement and collaboration. The core functionality of Flarum is provided by the flarum/core and flarum/framework packages. These packages handle various aspects of the forum, including user authentication, content management, and file handling.
Vulnerability Detail
Flarum is affected by a vulnerability that enables an attacker to exploit Local File Inclusion (LFI) and Blind Server-Side Request Forgery (SSRF) through the avatar upload feature. This vulnerability allows an attacker to manipulate the application to execute unintended actions, such as conducting SSRF attacks, disclosing local file contents, or performing a blind oracle attack. The vulnerability arises from the behavior of the intervention/image package, which interprets the uploaded file contents as a URL and fetches its contents. This behavior can be abused by an attacker to trick the application into fetching arbitrary URLs and potentially accessing sensitive information or performing unauthorized actions.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
composer require flarum/core:1.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround for the SSRF aspect of the vulnerability, you can disable PHP's allow_url_fopen directive. This can be done by modifying the php.ini file or using a runtime configuration option. Disabling allow_url_fopen prevents the application from fetching external files via URLs, reducing the risk of SSRF attacks. However, this workaround may impact certain legitimate functionalities that rely on fetching external resources.
Conclusion
Flarum, a popular forum software, is vulnerable to LFI and Blind SSRF attacks through the avatar upload feature. The vulnerability arises from the behavior of the intervention/image package used by Flarum. To mitigate the risk, it is crucial to update Flarum to version 1.8.0 or later, which includes the necessary patches. Additionally, disabling PHP's allow_url_fopen directive can serve as a temporary workaround for the SSRF aspect of the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flarum/core →
FAQ
Flarum is a forum software used for creating and managing online discussion forums.
LFI stands for Local File Inclusion. It is a vulnerability that allows an attacker to include local files on a server through a web application. In the context of this Flarum vulnerability, LFI can be exploited to disclose sensitive files on the server.
Blind SSRF (Server-Side Request Forgery) is a type of vulnerability where an attacker can make requests to internal or external resources on behalf of the vulnerable server. In the case of this Flarum vulnerability, Blind SSRF can be used to fetch arbitrary URLs and potentially access sensitive information or perform unauthorized actions.
To fix the vulnerability, update your Flarum installation to version 1.8.0 or later. This will include the necessary patches to address the LFI and Blind SSRF vulnerabilities.
Yes, as a temporary workaround for the SSRF aspect of the vulnerability, you can disable PHP's allow_url_fopen directive. This prevents the application from fetching external files via URLs and reduces the risk of SSRF attacks. However, this workaround may impact certain legitimate functionalities that rely on fetching external resources.
References
Related vulnerabilities
Recent vulnerabilities recorded for flarum/core.
