Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location.
Impact version: latest
Test with PHP 7.2
The vulnerable code is located in the ccv/js/loader.php file, which does not sufficiently validate the src parameter, leading to a taint introduced from the $url variable into the tainted function curl_init, which after the execution of the curl_exec function sends a request to the URL specified by the src parameter, eventually leading to an SSRF vulnerability.
Because the src parameter is unrestricted, it is also possible to use the server side to send requests, such as probing intranet web services. The corresponding PoC is as follows:
Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location.
Impact version: latest Test with PHP 7.2
The vulnerable code is located in the
ccv/js/loader.php
file, which does not sufficiently validate the src parameter, leading to a taint introduced from the$url
variable into the tainted functioncurl_init
, which after the execution of thecurl_exec
function sends a request to the URL specified by the src parameter, eventually leading to an SSRF vulnerability.Because the
src
parameter is unrestricted, it is also possible to use the server side to send requests, such as probing intranet web services. The corresponding PoC is as follows: