CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2 are vulnerable to a server-side request forgery (SSRF) flaw in the GraphQL save<Volume>Asset mutation, allowing attackers with asset-creation permissions to exploit incomplete IP validation. This vulnerability can lead to the disclosure of internal HTTP content, forced outbound requests to internal networks, and enumeration of internal services. Organizations using affected Craft CMS versions should prioritize remediation to mitigate potential data exposure and internal network attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.