Cloudreve SSRF via incorrect authorization in admin node test endpoints

Executive brief

Cloudreve is a file management system that supports multiple cloud storage backends. A security flaw allows users with limited 'read-only' administrative access to bypass intended restrictions and trigger the server to make unauthorized network requests. This could be used by an attacker to probe internal network services or interact with other private systems that the Cloudreve server can reach.

Technical details

Cloudreve's administrative API incorrectly enforces authorization scopes on the 'node/test' and 'node/test/downloader' endpoints. While state-changing operations like creating or deleting nodes require the 'Admin.Write' scope, these test endpoints only require 'Admin.Read'. An attacker with a read-scoped OAuth token can provide a malicious node configuration containing an arbitrary URL. The server then performs a POST request to that URL to 'ping' the node, leading to blind SSRF and potential internal network reconnaissance. The issue was addressed by requiring the 'Admin.Write' scope for these test routes.

Affected products

• Cloudreve Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4
• Cloudreve Cloudreve/v4 < 4.0.0-20260626022735-332a9d800205

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/DavidCarliez
• https://github.com/DavidCarliez
• https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D
• https://api.github.com/users/DavidCarliez/repos
• https://avatars.githubusercontent.com/u/271374756?v=4
• https://api.github.com/users/DavidCarliez/events%7B/privacy%7D