Description

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.0",
  "pubDate": "2026-08-12T15:17:35.867Z",
  "pubdate": "2026-08-12T15:17:35.867Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the Aimeos Pagible content management system prior to version 0.10.4.\nThe vulnerability affects the administrative proxy route (cmsproxy), allowing attackers to bypass URL restrictions and interact with internal network resources and cloud metadata endpoints.\nThe root cause is a Time-of-Check to Time-of-Use (TOCTOU) race condition between the security validation phase and the subsequent HTTP request execution phase.\nExploitation requires the ability to target the administrative proxy route and leverage DNS rebinding techniques to manipulate IP resolution.\nThe impact includes unauthorized internal network reconnaissance, potential data exfiltration from private services, and unauthorized access to cloud metadata services.\nRisk implications are severe for deployments exposed to untrusted networks, necessitating an immediate upgrade to version 0.10.4.",
  "technicalDetails": "The vulnerability resides in the administrative proxy route (`cmsproxy`) of the Aimeos Pagible content management system for all versions prior to 0.10.4.\nThe primary mechanism of the vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition occurring during the URL processing lifecycle.\nDuring the Time-of-Check phase, the application initiates validation routines against the supplied URL to ensure the destination resolves to a safe, public IP address, intended to block access to internal networks, loopback addresses, and cloud metadata endpoints.\nHowever, a critical security flaw manifests because the DNS resolution performed during the validation check is distinct from the DNS resolution performed during the Time-of-Use phase when the actual HTTP request is dispatched.\nAn attacker exploits this behavior using DNS rebinding techniques by configuring a malicious authoritative DNS server with a very low Time-To-Live (TTL).\nInitially, the domain resolves to a safe, public IP address to successfully pass the application's URL validation phase.\nSubsequently, during the HTTP request phase, the domain resolves to a restricted internal IP address, such as 127.0.0.1, internal subnet gateways, or cloud metadata services (e.g., 169.254.169.254).\nBecause the application re-resolves or issues the request based on the manipulated DNS response without re-validating the final IP destination, the HTTP client executes the request against the restricted internal resource.\nThis behavior bypasses network boundaries, exposing internal services, administrative interfaces, and sensitive infrastructure endpoints to unauthorized external manipulation.\nAffected versions include all releases of Aimeos Pagible prior to 0.10.4, which introduces the necessary security controls to resolve the TOCTOU flaw."
}