CVE-2023-40033

描述

## Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. ### Patches This has been patched in Flarum **v1.8**. ## Workarounds As a temporary workaround for the SSRF aspect of the vulnerability, one can disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs. ### Credits Adam Kues - [Assetnote](https://assetnote.io/)

如何修補 CVE-2023-40033

要修補 CVE-2023-40033,請將受影響套件升級到下列已修補版本。

• —升級至 1.8.0 或更新版本
• —升級至 1.8.0 或更新版本

CVE-2023-40033 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.8.0
• from 0, < 1.8.0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-40033
• PATCHgithub.com/flarum/framework
• WEBgithub.com/flarum/framework/commit/d1059c1cc79fe61f9538f3da55e8f42abbede570
• WEBgithub.com/flarum/framework/security/advisories/GHSA-67c6-q4j4-hccg