Squidex vulnerabilities

Squidex is an open source headless content management system. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.

Squidex before version 7.23.0 has an SSRF vulnerability due to missing SSRF protection on the `Jint` HTTP client used by scripting engine functions. An authenticated low-privileged user can force the server to make arbitrary outbound HTTP requests to internal or attacker-controlled endpoints. This can lead to access to internal services and cloud metadata endpoints, potentially exposing credentials and enabling lateral movement.

Squidex before version 7.23.0 has an SSRF vulnerability in the `RestoreController.PostRestoreJob` endpoint, which allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient without SSRF protection. A malicious or compromised admin can use this to probe internal services, access cloud metadata, or perform internal reconnaissance.