Adlisting Classified Ads 2.14.0 - Information Disclosure

highseverity

7.5CVSS score

46%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.

Impact

Unauthenticated attackers can access sensitive API keys, server keys, and app IDs exposed in redirect responses, potentially compromising integrated third-party services and the Google Maps API used by the classified ads platform.

Fix

Update Adlisting to a version newer than 2.14.0 that removes sensitive credentials from client-side code and stores API keys securely on the server side.

How to confirm it

Send: GET {{BaseURL}}/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "google_map_key", "api_key", "auth_domain")

Run it with nuclei: nuclei -id CVE-2023-4168 -u <target>

The full check

id: CVE-2023-4168

info:
  name: Adlisting Classified Ads 2.14.0 - Information Disclosure
  author: r3Y3r53
  severity: high
  description: |
    Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.
  impact: |
    Unauthenticated attackers can access sensitive API keys, server keys, and app IDs exposed in redirect responses, potentially compromising integrated third-party services and the Google Maps API used by the classified ads platform.
  remediation: |
    Update Adlisting to a version newer than 2.14.0 that removes sensitive credentials from client-side code and stores API keys securely on the server side.
  reference:
    - https://www.exploit-db.com/exploits/51667
    - https://templatecookie.com/demo/adlisting-classified-ads-script
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4168
    - https://vuldb.com/?ctiid.236184
    - https://vuldb.com/?id.236184
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-4168
    cwe-id: CWE-200,NVD-CWE-noinfo
    epss-score: 0.45972
    epss-percentile: 0.98816
    cpe: cpe:2.3:a:templatecookie:adlisting:2.14.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: templatecookie
    product: adlisting
  tags: cve,cve2023,adlisting,exposure,templatecookie,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword="

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "google_map_key", "api_key", "auth_domain")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from