Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86385763

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery
# Date: 2/26/2019
# Exploit Author: Alexandre Basquin
# Vendor Homepage: https://blog.thehive-project.org
# Software Link: https://github.com/TheHive-Project/Cortex
# Version: Cortex <= 2.1.3
# Tested on: 2.1.3
# CVE : CVE-2019-7652

# Exploit description

The "UnshortenLink_1_0" analyzer used by Cortex contains an SSRF vulnerability 


POC:

1. Create a new analysis

2. Select Data Type "URL"

3. Put your SSRF payload in the Data parameter (e.g. "http://127.0.0.1:22")

4. Result can be seen in the main dashboard.


Reported to TheHive Project by Alexandre Basquin on 1/24/2019

The issue has been fixed in UnshortenLink 1.1 released within Cortex-analyzers 1.15.2

References:

https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/