EUVD-2026-44490
GHSA-9wvj-rhhh-8292
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via any authenticated member (PR:L); scope changes to internal systems (S:C); read-only SSRF yields high downstream confidentiality impact with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses. Attackers can leverage SMF's automatic HMAC signature generation for any embedded image URL to obtain valid signed proxy requests targeting internal services such as cloud instance metadata endpoints, internal web applications, and container network services.
AnalysisAI
Server-side request forgery in Simple Machines Forum's image proxy allows any authenticated forum member to force the SMF host to make arbitrary internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. Because SMF automatically generates HMAC signatures authorizing any image URL the proxy encounters, an attacker can obtain a valid signed request targeting cloud instance metadata endpoints (169.254.169.254), RFC1918 internal web applications, and container network services - with no public exploit code identified at time of analysis and no CISA KEV listing. The highest-impact exposure is in cloud-hosted deployments where IMDS credential theft via SSRF could enable lateral movement beyond the SMF host itself.
Technical ContextAI
The vulnerability resides in SMF's image proxy subsystem (ProxyServer.php, Url.php, and the WebFetch API layer including CurlFetcher.php and SocketFetcher.php), which fetches external images server-side to protect user privacy and avoid mixed-content browser warnings. Prior to the fix, the proxy performed only syntactic hostname validation - blocking literal 'localhost' strings and direct IP literals in the URL - but did not resolve hostnames via DNS and validate the resulting IP against private (RFC1918), loopback, link-local (169.254.0.0/16), or other reserved address ranges. An attacker could register or control a domain that resolves to 169.254.169.254 or 10.x.x.x, bypassing all hostname-level checks. SMF's HMAC-based URL signing for proxy requests compounded the issue: the forum automatically computed valid authorization tokens for any image URL, giving attacker-controlled requests the same trust as legitimate image fetches. The root cause is CWE-918 (Server-Side Request Forgery). The fix introduced a centralized isFetchSafe() method in WebFetchApi.php that resolves hostnames and validates resulting IPs - including NAT64 addresses (64:ff9b::/96) via a PHP bug workaround in IP.php - and added redirect-time re-validation in CurlFetcher.php to block 302-redirect bypass chains. The CPE cpe:2.3:a:simplemachines:smf covers all affected installations.
RemediationAI
Upstream fix available (GitHub commits); a tagged release version for SMF 2.1.x is identified in EUVD data as 2.1.7 - update to SMF 2.1.7 or apply commit 4bf35cf9e45573a5f55a6f52995086c1da89c096 for the 2.1 branch, and apply commit b4d23dfd74a511587c605f9d294cefc3a75b4b26 for the 3.0 branch. Patch references: https://github.com/SimpleMachines/SMF/commit/4bf35cf9e45573a5f55a6f52995086c1da89c096 and https://github.com/SimpleMachines/SMF/commit/b4d23dfd74a511587c605f9d294cefc3a75b4b26. If immediate patching is not feasible, disabling SMF's image proxy feature in the admin settings eliminates the attack surface entirely - the trade-off is that external images in posts will load directly from their source domains, exposing user IP addresses to those third-party servers. For cloud-hosted deployments, enforcing IMDSv2 (AWS) or equivalent metadata service hardening at the infrastructure level is a recommended compensating control that prevents credential extraction from the IMDS endpoint, though it does not block SSRF probing of other internal services. Implementing egress filtering at the network or WAF layer to block server-initiated outbound HTTP connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses provides defense-in-depth and is effective regardless of patch status.
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and includ
free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allo
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 inte
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interfac
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service v
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrar
Authorization state-confusion in Simple Machines Forum (SMF) through version 2.1.7 enables any authenticated low-privile
Authorization bypass in Simple Machines Forum (SMF) 2.1 before 2.1.8 and 3.0 before 3.0 Alpha 5 lets any authenticated l
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today