CVE-2023-27163
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
request-baskets是rbaskets开源的一个Web服务。 request-baskets v1.2.1版本及之前版本存在安全漏洞，该漏洞源于通过组件/api/baskets/{name}发现包含服务器端请求伪造 (SSRF)漏洞。攻击者利用该漏洞通过特制的API请求访问网络资源和敏感信息。
Public Exploits 1
Nuclei · 1
CVE-2023-27163.yaml [template]
Possible ATT&CK Techniques 3 AI
T1557.001 · Name Resolution Poisoning and SMB Relay T1592.002 · Software T1127.001 · MSBuild
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-27163
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
request-baskets 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
request-baskets是rbaskets开源的一个Web服务。 request-baskets v1.2.1版本及之前版本存在安全漏洞，该漏洞源于通过组件/api/baskets/{name}发现包含服务器端请求伪造 (SSRF)漏洞。攻击者利用该漏洞通过特制的API请求访问网络资源和敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2023-27163
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Proof-of-Concept for Server Side Request Forgery (SSRF) in request-baskets (<= v.1.2.1) | https://github.com/entr0pie/CVE-2023-27163 | POC Details |
| 2 | To assist in enumerating the webserver behind the webserver SSRF CVE-2023-27163 | https://github.com/seanrdev/cve-2023-27163 | POC Details |
| 3 | CVE-2023-27163 | https://github.com/overgrowncarrot1/CVE-2023-27163 | POC Details |
| 4 | Poc of SSRF for Request-Baskets (CVE-2023-27163) | https://github.com/ThickCoco/CVE-2023-27163-POC | POC Details |
| 5 | PoC CVE-2023-27163, SSRF, request-baskets hasta v1.2.1 | https://github.com/davuXVI/CVE-2023-27163 | POC Details |
| 6 | Requests Baskets (CVE-2023-27163) and Mailtrail v0.53 | https://github.com/HusenjanDev/CVE-2023-27163-AND-Mailtrail-v0.53 | POC Details |
| 7 | CVE-2023-27163 - Request Baskets SSRF | https://github.com/rvizx/CVE-2023-27163 | POC Details |
| 8 | Golang PoC for CVE-2023-27163 Mailtrail Exploit | https://github.com/thomas-osgood/CVE-2023-27163 | POC Details |
| 9 | CVE-2023-27163 Request-Baskets v1.2.1 - Server-side request forgery (SSRF) | https://github.com/0xFTW/CVE-2023-27163 | POC Details |
| 10 | A tool to perform port scanning using vulnerable Request-Baskets | https://github.com/samh4cks/CVE-2023-27163-InternalProber | POC Details |
| 11 | Python implementation of CVE-2023-27163 | https://github.com/Hamibubu/CVE-2023-27163 | POC Details |
| 12 | CVE-2023-27163 Request-Baskets v1.2.1 - Server-side request forgery (SSRF) | https://github.com/cowsecurity/CVE-2023-27163 | POC Details |
| 13 | this is a script that exploits the CVE-2023-27163 vulnerability which is request-basket SSRF | https://github.com/KharimMchatta/basketcraft | POC Details |
| 14 | Proof of Concept for Server Side Request Forgery (SSRF) in request-baskets (V<= v.1.2.1) | https://github.com/MasterCode112/CVE-2023-27163 | POC Details |
| 15 | Request Baskets vulnerable exploit to Server-Side Request Forgery up to version 1.2.1 | https://github.com/mathias-mrsn/CVE-2023-27163 | POC Details |
| 16 | A exploit for the CVE-2023-27163 (SSRF) vulnerability in the web application request-baskets (<= v.1.2.1) | https://github.com/Rubioo02/CVE-2023-27163 | POC Details |
| 17 | PoC for SSRF in request-baskets v1.2.1 (CVE-2023-27163) | https://github.com/madhavmehndiratta/CVE-2023-27163 | POC Details |
| 18 | It is a simple script to automate internal port scanning dueto SSRF in requests-baskets v 1.2.1. this script can also assisst in solving 'SAU' machine from hackthebox | https://github.com/Rishabh-Kumar-Cyber-Sec/CVE-2023-27163-ssrf-to-port-scanning | POC Details |
| 19 | None | https://github.com/btar1gan/exploit_CVE-2023-27163 | POC Details |
| 20 | SSRF CVE-2023-27163 + maltrail vuln RCE | https://github.com/G4sp4rCS/htb-sau-automated | POC Details |
| 21 | Request Baskets is exposed. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/request-baskets-exposure.yaml | POC Details |
| 22 | CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE. | https://github.com/lukehebe/CVE-2023-27163 | POC Details |
| 23 | Proof of Concept exploit for Server Side Request Forgery vulnerability in Requests Basket v1.2.1 and before. | https://github.com/J0ey17/Exploit_CVE-2023-27163 | POC Details |
| 24 | PoC and internal port brute-forcer for CVE-2023-27163 | https://github.com/theopaid/CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer | POC Details |
| 25 | Request-Baskets <= 1.2.1 allows unauthenticated SSRF via the forward_url parameter when creating a new basket. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27163.yaml | POC Details |
| 26 | A exploit for the CVE-2023-27163 (SSRF) vulnerability in the web application request-baskets (<= v.1.2.1) | https://github.com/apaz-dev/CVE-2023-27163 | POC Details |
| 27 | CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE. | https://github.com/lukehebe/CVE-2023-27163-POC | POC Details |
| 28 | Exploit for CVE-2023-27163 - SSRF Baskets Requests | https://github.com/thealchimist86/CVE-2023-27163---SSRF-Baskets-Requests | POC Details |
| 29 | Exploit for CVE-2023-27163 - Maltrail(0.53) - RCE | https://github.com/thealchimist86/CVE-2023-27163---Maltrail-0.53---RCE | POC Details |
AI-Generated POC
Verified env
Premium
Reproduced successfully in a real sandbox
· Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker:
VULNERABLE: SSRF confirmed - request-baskets v1.2.1 forwarded request to internal http://target:8000/ and returned its secret body: PROOF_395fedaa755eeb4d
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code
· 3828 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-27163
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2023-27163 (2)
Other References for CVE-2023-27163 (4)
Same Patch Batch · n/a · 2023-03-31 · 24 CVEs total
| CVE-2023-1773 | 6.3 MEDIUM | Rockoa Configuration File webmainConfig.php code injection |
| CVE-2023-1784 | 5.3 MEDIUM | jeecg-boot API Documentation improper authentication |
| CVE-2023-1772 | 3.5 LOW | DataGear Diagram Type cross site scripting |
| CVE-2023-29141 | MediaWiki 安全漏洞 | |
| CVE-2023-29140 | MediaWiki 安全漏洞 | |
| CVE-2023-29139 | MediaWiki 安全漏洞 | |
| CVE-2023-29137 | MediaWiki 安全漏洞 | |
| CVE-2023-28879 | Artifex Software Ghostscript 缓冲区错误漏洞 | |
| CVE-2023-28877 | VTEX apps-graphql 安全漏洞 | |
| CVE-2023-28862 | LemonLDAP::NG 授权问题漏洞 | |
| CVE-2023-28464 | Linux kernel 资源管理错误漏洞 | |
| CVE-2023-27162 | openapi-generator 代码问题漏洞 | |
| CVE-2023-27160 | forem 代码问题漏洞 | |
| CVE-2023-27159 | Appwrite 代码问题漏洞 | |
| CVE-2023-26925 | D-Link DIR-882 安全漏洞 | |
| CVE-2023-26858 | PrestaSHp faqs SQL注入漏洞 | |
| CVE-2023-26830 | Gladinet CentreStack 代码问题漏洞 | |
| CVE-2023-26829 | Gladinet CentreStack 安全漏洞 | |
| CVE-2023-23594 | SATO America CL4NX 安全漏洞 | |
| CVE-2022-4899 | Zstandard 资源管理错误漏洞 |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2023-27163
No comments yet