Issue #60: XSS, arbitrary file deletion, Blade RCE, and admin SSRF vulnerability analysis

Vulnerability Key Information Summary Vulnerability Overview This Issue (#60) reports multiple security vulnerabilities, including: 1. XSS in JSON-LD theme output: The template fails to properly escape when using , allowing attacker-controllable input to break out of the JSON-LD block and inject executable scripts. 2. Arbitrary file deletion via Image Library Cleanup: A regular admin can authenticate to to obtain an API token with full permissions such as ; when creating an image entry, if does not start with or , the backend falls back to , enabling the deletion of files outside the project. 3. Blade execution in the Superadmin theme editor: Blade templates are bound to the superadmin role; once an attacker gains a superadmin session, they can execute arbitrary PHP code within Blade expressions. 4. Generic HTTP SSRF reachable by regular admins: Distribution management output is accessible to authenticated admins; a regular admin can create a pointing to an arbitrary target, triggering a server-side request to an attacker-chosen destination. Impact Scope XSS: Affects all pages using JSON-LD theme output; attacker-controllable input can inject tags such as . Arbitrary file deletion: Affects regular admin privileges; files outside the project (such as system files like ) can be deleted. Blade execution: Affects superadmin privileges; arbitrary PHP code can be executed. SSRF: Affects regular admin privileges; arbitrary HTTP requests can be initiated. Remediation XSS: Use flags such as , and ensure HTML escaping. Arbitrary file deletion: Strictly validate to ensure it starts with or ; otherwise, reject the input or fall back to . Blade execution: Sandbox the Blade expressions to restrict executable PHP functions and classes. SSRF: Validate the target URL of against a whitelist, restricting accessible domains and ports. POC Code XSS POC Arbitrary File Deletion POC Blade Execution POC SSRF POC

Goal Reached Thanks to every supporter — we hit 100%!

Issue #60: XSS, arbitrary file deletion, Blade RCE, and admin SSRF vulnerability analysis

More from this source