Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-11767

CVE-2019-11767: phpBB Server side request forgery (SSRF)

5.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-11767
GHSA ID
GHSA-4hx9-p925-qcv7
EPSS Score
0.44935%
CWE
CWE-918
Published
5/24/2022
Updated
4/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
phpbb/phpbbcomposer< 3.2.63.2.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the remote avatar handling functionality. Key functions are in profile field validation and remote avatar driver where:

  1. type_avatar::validate_profile_field handles user-supplied avatar URLs
  2. remote::get_data performs the actual HTTP request. The lack of proper validation for internal network targets in these functions allowed SSRF. The vendor's mitigation involved disabling remote avatars entirely, confirming these components' central role. Code structure analysis of phpBB's avatar handling architecture supports this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

S*rv*r si** r*qu*st *or**ry (SSR*) in p*p** ***or* *.*.* *llows ****kin* *or t** *xist*n** o* *il*s *n* s*rvi**s on t** lo**l n*twork o* t** *ost t*rou** t** r*mot* *v*t*r uplo** *un*tion.

Reasoning

T** vuln*r**ility st*ms *rom t** r*mot* *v*t*r **n*lin* *un*tion*lity. K*y *un*tions *r* in pro*il* *i*l* v*li**tion *n* r*mot* *v*t*r *riv*r w**r*: *. typ*_*v*t*r::v*li**t*_pro*il*_*i*l* **n*l*s us*r-suppli** *v*t*r URLs *. r*mot*::**t_**t* p*r*orm