GHSA-v3f3-cmj4-cvj9: SSRF
Impact
The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).
This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28.
Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
The action now requires a CP request, a valid formId, and form integration permissions (formie-showFormIntegrations / per-form variant on Craft 5; formie-manageFormIntegrations / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.
Workarounds
Restrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.
- Reported by Jorge González (jorge@jmilla.es)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Compensating control
Restrict front-end user registration and limit Control Panel access until Formie is upgraded.
Event History
Frequently Asked Questions
Which deployments are most exposed?
Any affected site where a low-privileged user can authenticate is exposed, including sites that allow public front-end registration. Such users could target configured CRM, email-marketing, or webhook integrations.
What does an attacker need to exploit this issue?
The attacker needs only an authenticated account; the vulnerable action did not enforce the appropriate form integration permissions. They can submit settings that replace an integration's outbound host, such as its apiUrl.
What information or access can exploitation provide?
The server may send stored API keys or OAuth tokens to the attacker-controlled host when it contacts the modified integration endpoint. The attacker can also use the behavior to probe internal network endpoints, and the remote response is returned in JSON rather than being blind.
Which versions contain the fix?
The issue is fixed in Formie 3.1.31 for Craft 5 and 2.2.23 for Craft 4. The corrected action requires a control-panel request, a valid formId, and the relevant form integration permission.