Description

Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

Summary

The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.

This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc) that allows access to all blocked IPs, not just IPv6 endpoints.

Severity

Bypass of cloud metadata SSRF protection for all blocked IPs

Required Permissions

Exploitation requires GraphQL schema permissions for:

Edit assets in the <VolumeName> volume

Create assets in the <VolumeName> volume

These permissions may be granted to:

Authenticated users with appropriate GraphQL schema access

Public Schema (if misconfigured with write permissions)

Technical Details

Vulnerable Code Flow

The code at src/gql/resolvers/mutations/Asset.php performs two separate DNS lookups:

// VALIDATION PHASE: First DNS resolution at time T1
private function validateHostname(string $url): bool
{
    $hostname = parse_url($url, PHP_URL_HOST);
    $ip = gethostbyname($hostname);  // DNS Lookup #1 - Returns safe IP

    if (in_array($ip, [
        '169.254.169.254',   // AWS, GCP, Azure IMDS...
Show more

Root Cause

Two separate DNS lookups occur:

Validation: gethostbyname() in validateHostname()

Request: Guzzle's internal DNS resolution via libcurl

An attacker controlling a DNS server can return different IPs for each query.

Bypass Mechanism

+-----------------------------------------------------------------------------+
| Attacker's DNS Server: evil.attacker.com                                    |
+-----------------------------------------------------------------------------+
| Query 1 (Validation - T1):                                                  |
|   Request:  A record for evil.attacker.com                                  |
|   Response: 1.2.3.4 (safe IP, TTL: 0)                                       |
|   Result:   Validation PASSES                                               |
+-----------------------------------------------------------------------------+...
Show more

Target Endpoints via DNS Rebinding

DNS rebinding allows access to all blocked IPs:

Attack Scenario

Attacker sets up DNS server with alternating responses

Attacker sends mutation with url: "http://evil.attacker.com/latest/meta-data/"

First DNS query returns safe IP (e.g., 1.2.3.4) → validation passes

Second DNS query returns metadata IP (169.254.169.254) → request to metadata

Attacker retrieves credentials from ANY cloud provider

Attacker can now achieve code execution by creating new instances with their SSH key

Remediation

Fix: DNS Pinning with CURLOPT_RESOLVE

Pin the DNS resolution - use the same resolved IP for both validation and request:

private function validateHostname(string $url): bool
{
    $hostname = parse_url($url, PHP_URL_HOST);

    // Resolve once
    $ip = gethostbyname($hostname);

    // Validate the resolved IP...
Show more

Alternative: Single Resolution with Immediate Use

// Resolve to IP and use IP directly in URL
$ip = gethostbyname($hostname);

if (in_array($ip, $blockedIPs)) {
    return false;
}

// Make request directly to IP with Host header...
Show more

Additional Mitigations

Resources

https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575

GHSA-x27p-wfqw-hfcc - Original SSRF vulnerability (CVE-2025-68437)

DNSrebinder - Lightweight Python DNS server for testing DNS rebinding vulnerabilities; responds with legitimate IP for first N queries, then rebinds to target IP

Singularity DNS Rebinding Tool

rbndr DNS Rebinding Service

CURLOPT_RESOLVE Documentation

OWASP SSRF Prevention Cheat Sheet

Aliases

References