VYPR
← All advisories
High severityNVD Advisory· Published Aug 16, 2023· Updated Oct 2, 2024

Server-Side Request Forgery via Avatar upload in flarum

CVE-2023-40033

Description

Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the intervention/image package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's allow_url_fopen which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
flarum/corePackagist
< 1.8.01.8.0
flarum/frameworkPackagist
< 1.8.01.8.0

Affected products

1

Patches

1
d1059c1cc79f

fix: improve avatar upload functionality

https://github.com/flarum/frameworkSami MazouzMay 20, 2023via ghsa
commit
5 files changed · +5 −5
  • framework/core/js/src/forum/components/AvatarEditor.js+1 −1 modified
    @@ -204,7 +204,7 @@ export default class AvatarEditor extends Component {
 
   /**
    * After a successful upload/removal, push the updated user data into the
-   * store, and force a recomputation of the user's avatar color.
+   * store, and force a re-computation of the user's avatar color.
    *
    * @param {object} response
    * @protected
  • framework/core/src/Api/Controller/UploadFaviconController.php+1 −1 modified
    @@ -62,7 +62,7 @@ protected function makeImage(UploadedFileInterface $file): Image
             ]);
         }
 
-        $encodedImage = $this->imageManager->make($file->getStream())->resize(64, 64, function ($constraint) {
+        $encodedImage = $this->imageManager->make($file->getStream()->getMetadata('uri'))->resize(64, 64, function ($constraint) {
             $constraint->aspectRatio();
             $constraint->upsize();
         })->encode('png');
  • framework/core/src/Api/Controller/UploadLogoController.php+1 −1 modified
    @@ -38,7 +38,7 @@ public function __construct(SettingsRepositoryInterface $settings, Factory $file
      */
     protected function makeImage(UploadedFileInterface $file): Image
     {
-        $encodedImage = $this->imageManager->make($file->getStream())->heighten(60, function ($constraint) {
+        $encodedImage = $this->imageManager->make($file->getStream()->getMetadata('uri'))->heighten(60, function ($constraint) {
             $constraint->upsize();
         })->encode('png');
  • framework/core/src/User/AvatarValidator.php+1 −1 modified
    @@ -87,7 +87,7 @@ protected function assertFileMimes(UploadedFileInterface $file)
         }
 
         try {
-            $this->imageManager->make($file->getStream());
+            $this->imageManager->make($file->getStream()->getMetadata('uri'));
         } catch (NotReadableException $_e) {
             $this->raise('image');
         }
  • framework/core/src/User/Command/UploadAvatarHandler.php+1 −1 modified
    @@ -74,7 +74,7 @@ public function handle(UploadAvatar $command)
 
         $this->validator->assertValid(['avatar' => $command->file]);
 
-        $image = $this->imageManager->make($command->file->getStream());
+        $image = $this->imageManager->make($command->file->getStream()->getMetadata('uri'));
 
         $this->events->dispatch(
             new AvatarSaving($user, $actor, $image)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.