Junglewise Threat Intelligence

CVE-2016-7999: SPIP SSRF in valider_xml.php

CVE-2016-7999 · Severity: high · CVSS 7.4 · Published 2017-01-18

Technologies: Spip. Vendors: Spip.

Executive brief

SPIP, a popular open-source content management system, is vulnerable to a security flaw in its XML validation component. An attacker can trick the server into making unauthorized network requests to internal or external systems. This could allow an attacker to bypass firewalls, scan internal networks, or interact with sensitive services that are not normally accessible from the internet.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SPIP versions 3.1.2 and earlier within the `ecrire/exec/valider_xml.php` script. The vulnerability is caused by insufficient validation of the `var_url` parameter in the `valider_xml` action, which allows remote attackers to initiate HTTP or FTP requests from the server. Specifically, the `is_dir()` function and `recuperer_page()` are called on user-supplied URLs, enabling an attacker to probe internal network resources or bypass access controls. The fix involves rejecting URLs containing protocol delimiters like '://' to prevent outbound network traffic. This was patched in SPIP 3.1.3.

Affected products

  • SPIP SPIP <= 3.1.2

Timeline

  • 2016-09-15: disclosed: Initial discovery by Sysdream Labs
  • 2016-09-27: patched: SPIP team corrected the vulnerability in repository revisions 23188 and 23193
  • 2016-09-30: patched: SPIP 3.1.3 released
  • 2017-01-18: advisory: NVD publication date

References

Related threats