CVE-2023-45966 PoC — remak42 代码问题漏洞

Source

https://github.com/jet-pentest/CVE-2023-45966

Associated Vulnerability

Title:remak42 代码问题漏洞 (CVE-2023-45966)
Description:remak42是一个自托管、轻量级且简单（但功能齐全）的评论引擎，不会监视用户。 remak42 1.12.1及之前版本存在安全漏洞，该漏洞源于存在服务器请求伪造（SSRF）漏洞。

Description

Blind SSRF in umputun/remark42 <= 1.12.1

Readme

# CVE-2023-45966
Blind SSRF in umputun/remark42 <= 1.12.1
[Suggested description]
An issue was found in umputun/remark42 <= 1.12.1. Malicious JSON in POST request to /api/v1/comment?site=<SITE_ID> leads to Blind SSRF due to missing `title` field and insufficient filtering of `url` field in comment creation request.
------------------------------------------
[Additional Information]
Fixed in commit: efceed6
------------------------------------------
[VulnerabilityType Other]
CWE-918: Server Side Request Forgery
------------------------------------------
[Vendor of Product]
https://github.com/umputun
------------------------------------------
[Affected Product Code Base]
Affected version: umputun/remark42 <= 1.12.1
------------------------------------------
[Affected Component]
/api/v1/comment
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
false
------------------------------------------
[Impact Denial of Service]
false
------------------------------------------
[Impact Escalation of Privileges]
false
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
An attacker able to send crafted JSON 
------------------------------------------
[Discoverer]
Dmitry Kuramin (Jet Infosystems, jet.su)
------------------------------------------
[Reference]
https://jet.su/vuln

File Snapshot


 [4.0K]  /data/pocs/f2b6c0942d4a5b3c01d59c4257c5facd8503314e
└── [1.4K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!