GHSA-2XMM-M4WV-3FJH: Incomplete Scheme Validation in October CMS Image Resizer

October CMS incorporates an image resizing component that processes local and remote image resources. The core of this system handles URLs and local file paths to retrieve, resize, and cache images.

The vulnerability, designated as GHSA-2XMM-M4WV-3FJH, resides within the scheme validation routine of the image resizer. The component classifies any input string containing the substring :// as an external URL. This over-inclusive classification allows arbitrary URI schemes, including dangerous PHP stream wrappers, to bypass designed validation checks.

This security weakness affects October CMS installations from version 4.3.0 up to, but not including, version 4.3.5. Exploitation of the flaw can lead to untrusted metadata deserialization, which may result in remote code execution under specific conditions.

The root cause of this vulnerability lies in the implementation of the ResizeImageItem::fromObject() method within October CMS. This method is responsible for instantiating image representation objects based on user-supplied sources.

To determine if a source string represents a remote resource, the logic checks for the presence of the scheme indicator ://. The implementation assumes that any string containing :// is an external HTTP or HTTPS URL, subsequently routing the path to the self::fromUrl() initialization path.

Because the verification is limited to the existence of :// anywhere in the string, attackers can supply non-HTTP schemes like phar://, file://, or ftp://. When subsequent image operations are executed on the parsed path, PHP’s stream wrapper subsystem intercepts the request. For example, processing a phar:// stream triggers the parsing of the PHP Archive (PHAR) manifest, which automatically deserializes any serialized metadata embedded within the archive.

The following code illustrates the vulnerable routing mechanism. The method incorrectly uses a general substring search to identify external URLs instead of verifying explicit, permitted protocols.

// Vulnerable routing mechanism in ResizeImageItem::fromObject()
public static function fromObject($source) {
    if (is_string($source)) {
        // Loose validation: allows phar:// or file://
        if (strpos($source, '://') !== false) {
            return self::fromUrl($source);
        } 
        // ... local file handling ...
    }
}

The remediation implemented in version 4.3.5 restricts the accepted schemes specifically to HTTP and HTTPS protocols. The updated logic parses the scheme and matches it against an explicit whitelist of safe communication protocols.

// Remediated validation pattern
public static function fromObject($source) {
    if (is_string($source)) {
        $scheme = parse_url($source, PHP_URL_SCHEME);
        // Hardened check: only allow safe http/https schemes
        if ($scheme && in_array(strtolower($scheme), ['http', 'https'])) {
            return self::fromUrl($source);
        }
        // ... local file handling ...
    }
}

Exploitation of GHSA-2XMM-M4WV-3FJH requires a multi-stage attack path. The attacker must possess credentials or exploit a separate vector to upload a malicious PHP Archive disguised as an innocuous file type onto the server.

The uploaded file contains a serialized PHP object payload designed to trigger a gadget chain present within the application's dependencies. The attacker then submits the payload path using the phar:// stream wrapper to a feature that passes the value directly into the image resizer, such as a vulnerable backend template parameter or an unvalidated frontend input.

When the image resizer attempts to determine the dimensions or process the cached image, it invokes standard PHP filesystem functions. PHP parses the PHAR file structure, deserializes the malicious object from the metadata, and triggers the gadget chain's magic methods, executing code on the underlying operating system.

The primary impact of this vulnerability is untrusted deserialization (CWE-502). If an attacker successfully triggers the deserialization of a crafted PHAR archive, they can potentially achieve remote code execution (RCE) in the context of the web server process.

The realization of RCE depends on the presence of a valid deserialization gadget chain within the application's runtime class path. Since October CMS relies on various Laravel components and external Composer libraries, numerous well-documented gadget chains may exist.

The CVSS score is evaluated as 3.9 (Low) due to high requirements for privileges and user interaction. In standard configurations, only authenticated users with administrative or developer-level template authorization can supply strings directly to the image resizer component.

The recommended course of action is upgrading the October CMS package (october/october) to version 4.3.5 or higher. This version implements strict validation of schemes, restricting accepted remote protocols to HTTP and HTTPS.

If immediate upgrading is not possible, organizations should apply defense-in-depth mitigations. Developers must audit Twig templates and PHP controllers to ensure no user-controlled strings are passed directly into the |resize filter or the ResizeImages::resize() API.

Additionally, administrators can disable the PHAR stream wrapper by adding phar to the stream_resolve_include_path configuration or using third-party PHP extensions to restrict the protocols available to PHP's file handling functions.