Statamic CMS Server-Side Request Forgery Vulnerability in Glide Image Manipulation

A server-side request forgery (SSRF) vulnerability has been identified in Statamic CMS versions prior to 5.73.11 and 6.4.0. When the Glide image manipulation feature is used in insecure mode, an unauthenticated user can exploit the image proxy to send HTTP requests to arbitrary URLs. This exploitation can access internal services, cloud metadata endpoints, and other hosts reachable from the server.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests to internal or external URLs, potentially accessing sensitive information or services.

Remediation

Users can upgrade to Statamic CMS versions 5.73.11 or 6.4.0 to address this vulnerability.