Closed Image proxy can be abused too easily

K

Kirby

Well-known member
Licensed customer
Affected version
2.3.0 Beta 6
Steps to reproduce
  1. Configure a proxy secret
  2. Start a new post
  3. Insert an external image
  4. Click preview
  5. Copy the generated image URL
Result
The generated proxy.php URL can now be used externally forever until the secret is changed without the image ever being displayed anywhere publically in XenForo

Suggested Mitigation
Make the hashes automatically expire after a configurable expire time
 
I was just thinking about this lol. Cloudflare makes this an even bigger problem. Though hotlinking protection somehow fixes this assuming it works as expected. I do change my secret key regularly but this means all image links in search engine are dead and require reindexing which is again not an optimal scenario.
 
Automated triage: Design issue

Thank you for reporting this issue. The image proxy signs each link from the image address and the site's proxy key only, with no time element, so a link stays valid until the key is changed. That is how the feature currently works rather than a fault in it, so adding expiring links would be a design change.

This is an automated assessment. A member of staff may review and update it.
 
Back
Top Bottom