The plugin’s DataTypes::getRawData() method reads a URL or a local path supplied by the user without validating the destination. The method resolves the path/url through Craft::getAlias($url), checks if the resolved path exists, and reads it with file_get_contents(). If the path is not a local file, the same method falls through to a Guzzle client and fetches the URL over the network.
A control panel user with Feed Me access can therefore supply arbitrary local paths (e.g., @root/.env, \etc\passwd), resulting in the reading of arbitrary files or in any internal/external URL leading to Server-Side Request Forgery (SSRF). This includes access to cloud instance metadata endpoints, which can lead to further compromise.
Although local file imports are a documented feature, the plugin imposes no path restrictions or allowlisting to prevent reading sensitive files outside intended data directories. The CSV parser is particularly effective for exfiltration, as it is very permissive of input formats.
Required Permissions
- Access the control panel
- Access Feed Me
Impact
The attacker can reach internal services and cloud metadata endpoints.
The plugin’s
DataTypes::getRawData()method reads a URL or a local path supplied by the user without validating the destination. The method resolves the path/url throughCraft::getAlias($url), checks if the resolved path exists, and reads it withfile_get_contents(). If the path is not a local file, the same method falls through to a Guzzle client and fetches the URL over the network.A control panel user with Feed Me access can therefore supply arbitrary local paths (e.g., @root/.env, \etc\passwd), resulting in the reading of arbitrary files or in any internal/external URL leading to Server-Side Request Forgery (SSRF). This includes access to cloud instance metadata endpoints, which can lead to further compromise.
Although local file imports are a documented feature, the plugin imposes no path restrictions or allowlisting to prevent reading sensitive files outside intended data directories. The CSV parser is particularly effective for exfiltration, as it is very permissive of input formats.
Required Permissions
Impact
The attacker can reach internal services and cloud metadata endpoints.