CVE-2021-30108
📋 TL;DR
Feehi CMS 2.1.1 has a server-side request forgery (SSRF) vulnerability where attackers can manipulate the HTTP Referer header to make the server send requests to arbitrary URLs. This allows attackers to probe internal networks, access internal services, or potentially chain with other vulnerabilities. Any Feehi CMS 2.1.1 installation with internet access is affected.
💻 Affected Systems
- Feehi CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could pivot to internal systems, access sensitive internal services, perform port scanning, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Attackers will use this to scan internal networks, access metadata services (like AWS/Azure instance metadata), or interact with internal APIs to steal data.
If Mitigated
With proper network segmentation and egress filtering, impact is limited to the server itself making outbound requests.
🎯 Exploit Status
Exploitation requires only modifying HTTP headers, making it trivial for attackers with basic web knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.2 or later
Vendor Advisory: https://github.com/liufee/cms/issues/57
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Download Feehi CMS 2.1.2 or later from the official repository. 3. Replace vulnerable files with patched versions. 4. Restart your web server.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allBlock or sanitize malicious Referer headers containing internal IP addresses or sensitive URLs
Network Egress Filtering
allRestrict outbound connections from the web server to only necessary external services
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable server from internal networks
- Deploy a reverse proxy with strict Referer header validation and filtering
🔍 How to Verify
Check if Vulnerable:
Test by sending a request with Referer header set to a controlled external URL and check if server makes request to itCheck Version:
Check CMS version in admin panel or read version.txt file in installation directoryVerify Fix Applied:
After patching, repeat the test - server should no longer make requests based on Referer header📡 Detection & Monitoring
Log Indicators:
- Unusual Referer headers containing internal IPs or unusual domains
- Outbound requests from web server to unexpected destinations
Network Indicators:
- Web server making outbound HTTP requests to internal IP ranges
- Requests to cloud metadata services (169.254.169.254, etc.)
SIEM Query:
source="web_server" AND (http.referer CONTAINS "192.168." OR http.referer CONTAINS "10." OR http.referer CONTAINS "172.16.")