Vuln Report

[yusiqo]

Lfi Vuln on url

/api/secure-https?imgurl=

i writed email but dont work email

[clarkwinkelmann]

Hi yusiqo,

I am not sure if our FriendsOfFlarum email relay still work. If you prefer to share your findings privately, you can reach me at clark.winkelmann@gmail.com

You can also share the details here if you want. Unless the problem requires a complete refactoring of the extension we should be able to address it quickly.

I went through our code again but I don't see any obvious problem. It's possible to bypass the local IP restriction by using an DNS alias or a redirect, and maybe it's possible to bypass the protocol validation through a redirect as well? The response header check at the end should cause non-HTTP transport to not work, and the header check should also only leak the existence of a non-image file but not its content if it were to happen.

I have a more robust image proxy script in my premium Rich Embeds extension that I could share if we need it in this extension. It hooks into the redirect logic of Guzzle to re-validate the URL on every step.

The FoF extension also suffers from a risk of denial of service if an attacker intentionally streams an infinite size file.