lukehebe/cve-2023-27163-pocCVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE.
CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the SSRF to perfrom RCE.
This Python script exploits a Server-Side Request Forgery (SSRF) vulnerability (CVE-2023-27163) in Request Baskets versions up to 1.2.1. The vulnerability allows an attacker to create a basket via the /api/baskets/{name} endpoint, configuring it to forward HTTP requests to an internal or restricted service (e.g., http://localhost:8000). By chaining the SSRF with a Remote Code Execution (RCE) vulnerability in the internal service, the script injects a payload to establish a reverse shell.
Note: The script requires the attacker to have access to a local server that can serve a payload (e.g., a reverse shell script).
This was tested on the box "Sau" from HTB
