iteachyou Dreamer CMS edit cross site scripting

Vulnerability

Dreamer CMS version 4.1.3 is vulnerable to a Server-Side Request Forgery (SSRF) in the article editor's image upload functionality. The endpoint /admin/archives/edit allows authenticated users to embed images with arbitrary src URLs, enabling the server to make requests to external targets. The vulnerability is classified as CWE-918. [1]

Exploitation

An attacker with authentication to the backend can craft a POST request to /admin/archives/edit containing an ` tag with a src` pointing to an attacker-controlled server. The server will fetch the resource from the provided URL, effectively making an outbound request. The attacker must have access to the admin panel and be able to edit articles. [1]

Impact

Successful exploitation allows the attacker to force the server to make unauthorized requests to internal or external systems, potentially exposing sensitive information from internal services or enabling further attacks such as internal network scanning. The attack does not directly compromise the server itself but can lead to information disclosure. [1]

Mitigation

As of the publication date, no official patch has been released by the vendor. Users should restrict network access from the CMS server and monitor for unusual outbound traffic. Input validation on the image src parameter should be implemented to block arbitrary URLs. [1]