Place Your Ad Here

Bug Image proxy can be abused too easily

There is a bug in this version
K

Kirby

Guest
Steps to reproduce
  1. Configure a proxy secret
  2. Start a new post
  3. Insert an external image
  4. Click preview
  5. Copy the generated image URL
Result
The generated proxy.php URL can now be used externally forever until the secret is changed without the image ever being displayed anywhere publically in XenForo

Suggested Mitigation
Make the hashes automatically expire after a configurable expire time

Continue reading...
 
You must log in or register to reply here.

Similar threads

C
Solved Image Proxy: Some (valid) webp images throw "invalid type" error
Replies
0
Views
53
XenForo General Discussions
Cyberkef
C
K
Bug Image proxy always returns status code 200
Replies
0
Views
71
XenForo General Discussions
Kirby
K
F
XenForo Image proxy not proxying images from certain domains
Replies
0
Views
81
XenForo Development & Modifications
Fullmental
F
K
Bug Image Proxy Service caches local URLs
Replies
0
Views
136
XenForo General Discussions
Kirby
K
A
XenForo Image Proxy + Curl + User Agent
Replies
0
Views
297
XenForo Development & Modifications
akok
A
Top Bottom
Back