Vulnonym.com

CVE-2026-25870 - Prejudicial Construction

Description

DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Reference

https://github.com/doramart/DoraCMS/issues/268 https://www.doracms.net/ https://www.vulncheck.com/advisories/doracms-ueditor-remote-image-fetch-ssrf

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score

5.8

Base Severity

MEDIUM

Remediation Step-by-Step Guide

  1. Disable or Remove UEditor Remote Image Fetch Functionality
    • If the feature is not essential, disable or remove the remote image fetching capability entirely from DoraCMS.
  2. Implement URL Allowlisting
    • Restrict outbound requests to a predefined allowlist of trusted domains (e.g., only approved image hosts like cdn.example.com, images.githubusercontent.com).
    • Reject all URLs not explicitly on the allowlist.
  3. Block Internal and Private IP Ranges
    • Configure the HTTP client to block requests to RFC 1918 private IP ranges:
      • 10.0.0.0/8
      • 172.16.0.0/12
      • 192.168.0.0/16
    • Also block loopback addresses: 127.0.0.0/8 and ::1.
  4. Enforce Request Timeouts
    • Set a strict HTTP timeout (e.g., 3–5 seconds) for all outbound requests to prevent resource exhaustion via slowloris or hanging connections.
  5. Limit Response Size
    • Cap HTTP response sizes (e.g., 1–2 MB) to prevent memory exhaustion from large payloads.
  6. Validate and Sanitize Input
    • Use strict URL parsing libraries to validate the structure of user-supplied URLs.
    • Reject malformed or suspicious schemes (e.g., file://, gopher://, dict://).
  7. Apply Network-Level Protections
    • Use firewalls or egress filtering to restrict outbound traffic from the application server to only necessary external domains.
    • Implement network segmentation to isolate the DoraCMS server from internal services.
  8. Upgrade to a Patched Version
    • Upgrade DoraCMS to version 3.2 or later if a patch is available. If no patch exists, replace DoraCMS with a secure alternative.
  9. Log and Monitor Outbound Requests
    • Enable detailed logging of all outbound HTTP requests with source, destination, and response status.
    • Alert on requests to internal IPs or unusual domains.
  10. Conduct Security Testing
    • Perform penetration testing and SSRF vulnerability scans using tools like Burp Suite or OWASP ZAP to verify remediation effectiveness.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Controls

  • A.13.1.1 – Network Security Management: Requires controls to protect network services and prevent unauthorized access or misuse of network resources. SSRF enables internal network reconnaissance, violating this control.
  • A.13.2.4 – External Connectivity: Mandates secure configuration of connections to external networks, including restrictions on outbound requests. The lack of allowlisting and IP blocking directly contravenes this.
  • A.14.1.3 – Secure Development Policy: Requires secure coding practices to prevent vulnerabilities such as SSRF. The absence of input validation and server-side request controls violates secure development principles.
  • A.18.2.3 – Vulnerability Management: Requires systematic identification and remediation of vulnerabilities; unpatched SSRF in DoraCMS 3.1 is a failure of this control.

NIST SP 800-53 Controls

  • SI-11 – Information Leakage Prevention: Requires systems to prevent unintended information disclosure. SSRF can be exploited to probe internal networks, leading to data exposure.
  • SC-7 – Boundary Protection: Requires enforcement of security boundaries between trusted and untrusted zones. SSRF bypasses this by allowing the server to act as an internal proxy.
  • AC-17 – Remote Access: Requires controls over remote access mechanisms. SSRF effectively creates an unauthorized remote access vector.
  • SI-4 – System Monitoring: Requires monitoring for anomalous or malicious activity. Lack of logging outbound requests violates this control.
  • SI-10 – Information Input Validation: Requires validation of all external inputs. The failure to validate URLs constitutes a direct violation.
  • SI-16 – Information System Monitoring: Requires monitoring for malicious code and anomalous behavior, including outbound request patterns indicative of SSRF.