Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-40033

CVE-2023-40033:
Flarum vulnerable to LFI and Blind SSRF via Avatar upload

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-40033
GHSA ID
GHSA-67c6-q4j4-hccg
EPSS Score
0.37251%
CWE
CWE-98
Published
8/16/2023
Updated
11/9/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
flarum/corecomposer< 1.8.01.8.0
flarum/frameworkcomposer< 1.8.01.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the intervention/image package interpreting file streams as URLs. The pre-patch code passed $file->getStream() to imageManager->make(), which reads raw content. If the uploaded file contained a URL string (with spoofed MIME), the library would fetch it, enabling SSRF/LFI. The patch replaced getStream() with getStream()->getMetadata('uri'), forcing the library to treat the input as a local file path instead of raw content, mitigating URL interpretation. The modified functions in the commit diff directly correlate to avatar/file upload handlers, making them the entry points for exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Imp**t T** *l*rum *orum so*tw*r* is *****t** *y * vuln*r**ility t**t *llows *n *tt**k*r to *on*u*t * *lin* SSR* *tt**k or *is*los* *ny *il* on t** s*rv*r, *v*n wit* * **si* us*r ***ount on *ny *l*rum *orum. *y uplo**in* * *il* *ont*inin* * URL *n*

Reasoning

T** vuln*r**ility st*ms *rom t** int*rv*ntion/im*** p**k*** int*rpr*tin* *il* str**ms *s URLs. T** pr*-p*t** *o** p*ss** `$*il*->**tStr**m()` to `im***M*n***r->m*k*()`, w*i** r***s r*w *ont*nt. I* t** uplo**** *il* *ont*in** * URL strin* (wit* spoo**