Description
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
oqtane oqtane.framework
Default version status: unaffected
1.0.0 to < 10.3.0affected
pkg:github/oqtane/oqtane.framework