POC详情： e6683f2647902674463732e4a19faa390e7bbdfd

来源
https://github.com/lukehebe/CVE-2023-27163
关联漏洞
标题： request-baskets 代码问题漏洞 (CVE-2023-27163)
描述：request-baskets是rbaskets开源的一个Web服务。 request-baskets v1.2.1版本及之前版本存在安全漏洞，该漏洞源于通过组件/api/baskets/{name}发现包含服务器端请求伪造 (SSRF)漏洞。攻击者利用该漏洞通过特制的API请求访问网络资源和敏感信息。
描述
CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE.
介绍
# CVE-2023-27163
CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE.

This Python script exploits a Server-Side Request Forgery (SSRF) vulnerability (CVE-2023-27163) in Request Baskets versions up to 1.2.1. The vulnerability allows an attacker to create a basket via the /api/baskets/{name} endpoint, configuring it to forward HTTP requests to an internal or restricted service (e.g., http://localhost:8000). By chaining the SSRF with a Remote Code Execution (RCE) vulnerability in the internal service, the script injects a payload to establish a reverse shell.


Note: The script requires the attacker to have access to a local server that can serve a payload (e.g., a reverse shell script).

This was tested on the box "Sau" from HTB


![CVE-2023-27163 Exploit GIF](./CVE-2023-27163.gif)
文件快照

 [4.0K]  /data/pocs/e6683f2647902674463732e4a19faa390e7bbdfd
├── [779K]  CVE-2023-27163.gif
├── [3.3K]  exploit.py
├── [1.0K]  README.md
└── [  47]  shell.sh

0 directories, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。