NeverStopExploiting用户9473
Server-Side Request Forgery (SSRF) in cskefu v8
输入“/”快速插入内容
Server-Side Request Forgery (SSRF) in cskefu v8
Server-Side Request Forgery (SSRF) in cskefu v8
BUG_Author: ChengxinXu
Affected Version: cskefu v8
Vulnerability Files:
•
com/cskefu/cc/controller/resource/MediaController.java
Description:
1.
SSRF via Media Resource Proxy:
◦
In the file com/cskefu/cc/controller/resource/MediaController.java, the url method (mapped to /res/url) accepts a user-controlled url parameter.
◦
Although there is a regular expression check (^https?://.*/.*$), it only validates that the input starts with http:// or https:// and contains a path. It does not prevent requests to internal IP addresses (e.g., 127.0.0.1, 192.168.x.x) or valid internal domains.
2.
Exploiting the SSRF:
◦
The application uses new URL(url).openStream() to fetch the content of the provided URL
◦
An unauthenticated attacker can abuse this functionality to make the cskefu server send HTTP requests to arbitrary targets. This can be used to scan the internal network, access cloud instance metadata
3.
Vulnerable Code Snippet:
3.
Java
代码块
@RequestMapping("/url")
@Menu(type = "resouce", subtype = "image", access = true)
public void url(HttpServletResponse response, @Valid String url) throws IOException {
if (StringUtils.isBlank(url)) {
return;
}
// Weak validation: allows any HTTP/HTTPS URL with a path
if(!Pattern.matches("^https?://.*/.*$", url)) {
return;
}
// ...
// Vulnerable sink: fetches URL and returns content
try (InputStream input = new URL(url).openStream()) {
while ((length = input.read(data)) > 0) {
out.write(data, 0, length);
}
}
}
4.
Risk Analysis:
◦
Confidentiality Loss: Attackers can read the response of internal services.
◦
Network Mapping: Attackers can scan for open ports on the internal network.
◦
Denial of Service: Attackers might force the server to download large files or connect to slow services, exhausting server resources.
Proof of Concept:
1.
Internal Port Scanning / Service Access: Access the vulnerable endpoint with a URL pointing to the local loopback interface or an internal service. Note that the regex requires a path (slash) after the domain.
代码块
http://<target-ip>/res/url?url=http://target/
2.
Verifying the Exploit: