Blind SSRF in umputun/remark42 <= 1.12.1# CVE-2023-45966
Blind SSRF in umputun/remark42 <= 1.12.1
[Suggested description]
An issue was found in umputun/remark42 <= 1.12.1. Malicious JSON in POST request to /api/v1/comment?site=<SITE_ID> leads to Blind SSRF due to missing `title` field and insufficient filtering of `url` field in comment creation request.
------------------------------------------
[Additional Information]
Fixed in commit: efceed6
------------------------------------------
[VulnerabilityType Other]
CWE-918: Server Side Request Forgery
------------------------------------------
[Vendor of Product]
https://github.com/umputun
------------------------------------------
[Affected Product Code Base]
Affected version: umputun/remark42 <= 1.12.1
------------------------------------------
[Affected Component]
/api/v1/comment
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
false
------------------------------------------
[Impact Denial of Service]
false
------------------------------------------
[Impact Escalation of Privileges]
false
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
An attacker able to send crafted JSON
------------------------------------------
[Discoverer]
Dmitry Kuramin (Jet Infosystems, jet.su)
------------------------------------------
[Reference]
https://jet.su/vuln
登录后查看神龙缓存的 POC 文件快照
登录查看