| Titel | Sparksuite SimpleMDE 1.11.2 Server-Side Request Forgery SSRF |
|---|
| Beschreibung | An unauthenticated attacker can make internal requests on the target server, with the aim of carrying out attacks on the victim's infrastructure, potentially opening new paths and exploitation combinations for other vulnerabilities.
The vulnerability in the markdown converter service occurs due to the lack of treatment and validation of user input, allowing an attacker to use the following payload to view an internal service:
<iframe src="http://127.0.0.1:PORT"></iframe>
Poc Video: https://youtu.be/t-mDofraMcc
References:
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
https://portswigger.net/web-security/ssrf
|
|---|
| Quelle | ⚠️ https://github.com/sparksuite/simplemde-markdown-editor |
|---|
| Benutzer | Anonymous User |
|---|
| Einreichung | 14.01.2024 01:12 (vor 3 Jahren) |
|---|
| Moderieren | 17.01.2024 14:37 (4 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 251373 [Sparksuite SimpleMDE bis 1.11.2 iFrame Cross Site Scripting] |
|---|
| Punkte | 20 |
|---|