| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| craftcms/cms | ≥ 3.5.0, < 4.16.19≥ 5.0.0-RC1, < 5.8.23 | 4.16.195.8.23 |
| craft cms | = 3.5.0= 5.0.0≥ 3.5.1, < 4.16.19≥ 5.0.1, < 5.8.23 | 4.16.195.8.23 |
The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.
This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc) that allows access to all blocked IPs, not just IPv6 endpoints.
Bypass of cloud metadata SSRF protection for all blocked IPs
Exploitation requires GraphQL schema permissions for:
<VolumeName> volume<VolumeName> volumeThese permissions may be granted to:
The code at src/gql/resolvers/mutations/Asset.php performs two separate DNS lookups:
// VALIDATION PHASE: First DNS resolution at time T1
private function validateHostname(string $url): bool
{
$hostname = parse_url($url, PHP_URL_HOST);
$ip = gethostbyname($hostname); // DNS Lookup #1 - Returns safe IP
if (in_array($ip, [
'169.254.169.254', // AWS, GCP, Azure IMDS
'169.254.170.2', // AWS ECS metadata
'100.100.100.200', // Alibaba Cloud
'192.0.0.192', // Oracle Cloud
])) {
return false; // Check passes - IP looks safe
}
return true;
}
// ... time gap between validation and request ...
// REQUEST PHASE: Second DNS resolution at time T2 (inside Guzzle)
$response = $client->get($url); // DNS Lookup #2 - Guzzle resolves DNS AGAIN
// Now returns 169.254.169.254!
Two separate DNS lookups occur:
gethostbyname() in validateHostname()An attacker controlling a DNS server can return different IPs for each query.
+-----------------------------------------------------------------------------+
| Attacker's DNS Server: evil.attacker.com |
+-----------------------------------------------------------------------------+
| Query 1 (Validation - T1): |
| Request: A record for evil.attacker.com |
| Response: 1.2.3.4 (safe IP, TTL: 0) |
| Result: Validation PASSES |
+-----------------------------------------------------------------------------+
| Query 2 (Guzzle Request - T2): |
| Request: A record for evil.attacker.com |
| Response: 169.254.169.254 (metadata IP, TTL: 0) |
| Result: Request goes to blocked IP -> CREDENTIALS STOLEN |
+-----------------------------------------------------------------------------+
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíDNS rebinding allows access to all blocked IPs:
| Target | Rebind To | Impact |
|---|---|---|
| AWS IMDS | 169.254.169.254 | IAM credentials, instance identity |
| AWS ECS | 169.254.170.2 | Container credentials |
| GCP Metadata | 169.254.169.254 | Service account tokens |
| Azure Metadata | 169.254.169.254 | Managed identity tokens |
| Alibaba Cloud | 100.100.100.200 | Instance credentials |
| Oracle Cloud | 192.0.0.192 | Instance metadata |
| Internal Services | 127.0.0.1, 10.x.x.x | Internal APIs, databases |
url: "http://evil.attacker.com/latest/meta-data/"1.2.3.4) → validation passes169.254.169.254) → request to metadataPin the DNS resolution - use the same resolved IP for both validation and request:
private function validateHostname(string $url): bool
{
$hostname = parse_url($url, PHP_URL_HOST);
// Resolve once
$ip = gethostbyname($hostname);
// Validate the resolved IP
if (in_array($ip, [
'169.254.169.254', '169.254.170.2',
'100.100.100.200', '192.0.0.192',
])) {
return false;
}
// Store for later use
$this->pinnedDNS[$hostname] = $ip;
return true;
}
// When making the request - CRITICAL: Use pinned IP
protected function makeRequest(string $url): ResponseInterface
{
$hostname = parse_url($url, PHP_URL_HOST);
$ip = $this->pinnedDNS[$hostname] ?? null;
$options = [];
if ($ip) {
// Force Guzzle/curl to use the SAME IP we validated
$options['curl'] = [
CURLOPT_RESOLVE => [
"$hostname:80:$ip",
"$hostname:443:$ip"
]
];
}
return $this->client->get($url, $options);
}
// Resolve to IP and use IP directly in URL
$ip = gethostbyname($hostname);
if (in_array($ip, $blockedIPs)) {
return false;
}
// Make request directly to IP with Host header
$client->get("http://$ip" . parse_url($url, PHP_URL_PATH), [
'headers' => [
'Host' => $hostname
]
]);
| Mitigation | Description |
|---|---|
| DNS Pinning (CURLOPT_RESOLVE) | Force same IP for validation and request |
| Single IP-based request | Use resolved IP directly in URL |
| Implement IMDSv2 | Requires token header (infrastructure-level) |
| Network egress filtering | Block metadata IPs at network level |