Listen to this Post
When a Security policy is active in Smarty, the `{fetch}` function validates the requested remote URL against the `trusted_uri` allowlist via Security::isTrustedUri(). For resources handled by `file_get_contents()` — including HTTPS URLs — PHP follows HTTP redirects by default. Because `isTrustedUri()` only validates the initial URL and does not re-validate any redirect targets, an attacker who can supply or influence a `{fetch}` target and has an open redirect available on a trusted host can redirect the request to an attacker-chosen internal endpoint. This bypasses the `trusted_uri` allowlist and enables Server-Side Request Forgery (SSRF). The attack path relies on the combination of application-level input, a trusted host with an open redirect, and PHP’s default redirect-following behavior. The vulnerability does not provide arbitrary code execution but can be leveraged for internal reconnaissance, reading internal services, or triggering undesired actions. It affects all Smarty releases prior to 4.5.7 on the 4.x line and prior to 5.8.2 on the 5.x line. The issue is fixed in versions 4.5.7 and 5.8.2.
DailyCVE Form:
Platform: Smarty (PHP)
Version: <4.5.7 / <5.8.2
Vulnerability: SSRF (CWE-918)
Severity: Medium (CVSS 6.9)
Date: 2026-08-31
Prediction: Patch already available
What Undercode Say:
Check Smarty version composer show smarty/smarty Verify if patch is applied (5.8.2 or 4.5.7+) php -r "require 'vendor/autoload.php'; echo Smarty::SMARTY_VERSION;"
Exploit: (Educational Purposes!)
An attacker crafts a fetch request with an initial URL on a trusted host that performs an open redirect to an internal endpoint:
{fetch file="https://trusted-host.example/redirect?url=http://169.254.169.254/latest/meta-data/"}
Because `file_get_contents()` follows the redirect and `isTrustedUri()` only validates the initial https://trusted-host.example/` URL, the request reaches the internal AWS metadata endpoint, bypassing the `trusted_uri` allowlist.follow_location => 0
<h2 style="color: blue;">Protection:</h2>
- Update Smarty to version 4.5.7 or 5.8.2, where `{fetch}` now passes a stream context that disables redirect following (,max_redirects => 1`) to `file_get_contents()` for remote resources.
– If updating is not immediately possible, reconfigure PHP to disable automatic HTTP redirects when calling `file_get_contents` through the `{fetch}` tag.
– Avoid fetching remote resources from within templates under untrusted control.
– Ensure hosts listed in `trusted_uri` do not expose open redirects.
– Implement strict validation or a whitelist for URLs supplied to the `{fetch}` function.
Impact:
An attacker who can supply a fetch target (or influence one) and who has an open redirect available on a trusted host can cause the server to issue requests to attacker-chosen internal endpoints, defeating the `trusted_uri` allowlist (server-side request forgery). This permits SSRF, enabling attackers to reach internal services, read data, or trigger undesired actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
