CVE-2023-27163 PoC — request-baskets 代码问题漏洞

Source

Associated Vulnerability

Description

PoC and internal port brute-forcer for CVE-2023-27163

Readme

# CVE-2023-27163 - Request-Baskets SSRF Proof of Concept

This is a proof-of-concept (PoC) exploit and a localhost port bruteforcer for **CVE-2023-27163**, a server-side request forgery (SSRF) vulnerability in [Request-Baskets](https://github.com/darklynx/request-baskets).

The PoC abuses the forward_url parameter to perform a brute-force scan of active services bound to the local interface.
Once discovered, these services can then be accessed by the attacker through the vulnerable forwarding mechanism.

---

## Description

- CVE: [CVE-2023-27163](https://nvd.nist.gov/vuln/detail/CVE-2023-27163)
- Affected: Request-Baskets
- Impact: Allows an attacker to trigger SSRF to internal addresses

---

## Requirements

- Python 3.x
- `requests` library
```bash
pip install requests
```

## Usage

```bash
python3 CVE-2023-27163.py -u https://TARGET_URL -b BASKET_NAME -p ports.txt
```

File Snapshot

 [4.0K]  /data/pocs/ab32ea710c670fe81a9b95ae3364db5005f314e9
├── [4.7K]  CVE-2023-27163.py
├── [ 889]  README.md
├── [ 41K]  top-ports-10000.txt
├── [4.9K]  top-ports-1000.txt
└── [ 25K]  top-ports-5000.txt

0 directories, 5 files

Remarks