Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Vulnerability

Admidio versions 5.0.0 through 5.0.6 contain an unrestricted URL fetch vulnerability in the SSO Metadata API endpoint at modules/sso/fetch_metadata.php. The endpoint accepts a URL via the $_GET['url'] parameter and validates it only with PHP's FILTER_VALIDATE_URL, which is a format validator that permits dangerous schemes such as file://, http://, ftp://, data://, and php://. The URL is then passed directly to file_get_contents() without further sanitization, allowing an authenticated administrator to read arbitrary local files or make requests to internal services [1][2].

Exploitation

An attacker with administrator privileges can supply a URL like file:///etc/passwd to read local files, or http://127.0.0.1/ to perform Server-Side Request Forgery (SSRF) against internal services. The file:// wrapper does not require allow_url_fopen to be enabled, making local file reads reliably exploitable. The full response body is returned verbatim is returned to the caller, enabling data exfiltration [2].

Impact

Successful exploitation can lead to disclosure of sensitive local files (e.g., configuration files, credentials), SSRF attacks against internal networks or cloud instance metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/), and potential lateral movement within the infrastructure [1][2].

Mitigation

The issue has been fixed in Admidio version 5.0.7. The patch restricts the allowed scheme to https:// only, validates that the resolved IP is not in private or reserved ranges, and replaces file_get_contents() with curl configured to enforce HTTPS-only connections [4]. Users should upgrade immediately.