Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect

Vulnerability

Overview

The saveAsset GraphQL mutation in Craft CMS validates the initial URL hostname and resolved IP against a blocklist to prevent server-side request forgery (SSRF). However, the underlying HTTP client (Guzzle) follows HTTP redirects by default, allowing an attacker to bypass the SSRF protections entirely [1][2]. The vulnerability affects versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 [1].

Exploitation

Method

An attacker can host a URL that passes the initial hostname/IP validation, but that URL redirects to a cloud metadata endpoint (e.g., AWS, GCP, Azure) or any internal IP address. Because Guzzle follows redirects, the attacker can force the server to fetch resources from internal networks or cloud instance metadata services that are normally inaccessible [1][3]. No authentication is required to trigger the mutation, and the attack can be performed remotely without special network privileges.

Impact

Successful exploitation allows an attacker to read sensitive information, such as cloud provider instance metadata, internal service credentials, or other data hosted on internal IP addresses. This could lead to lateral movement, privilege escalation, or data exfiltration depending on the environment [1][3]. The vulnerability is classified as an SSRF with high impact.

Mitigation

The issue is patched in Craft CMS versions 4.16.18 and 5.8.22 by disabling Guzzle's redirect following for this specific mutation [1][2][3]. Users should upgrade immediately. No workaround is provided for unpatched versions [1].