CVE-2023-27163

Vulnerability

Description

request-baskets is a web service for collecting HTTP requests. Versions up to v1.2.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the /api/baskets/{name} API endpoint [1][2]. The root cause is insufficient validation of the forward_url parameter, which allows an attacker to specify arbitrary URLs that the server will fetch [4].

Exploitation

An attacker can exploit this SSRF without authentication by sending a crafted POST request to /api/baskets/{name} with a malicious forward_url pointing to internal resources, such as http://127.0.0.1:80/test [3][4]. The vulnerability does not require prior authentication; only network access to the request-baskets service is needed [4]. The same SSRF also exists in the /baskets/{name} endpoint [3].

Impact

Successful exploitation allows an attacker to access network resources and sensitive information that are otherwise inaccessible from the external network [2]. This includes internal HTTP servers, databases, and cloud metadata endpoints [4]. The attacker can also cause information disclosure by fetching internal pages and exfiltrating data [4].

Mitigation

As of March 2023, the vendor has not released a patched version [1][2]. Users should restrict network access to the request-baskets server and avoid exposing it to untrusted networks. Until a fix is available, implementing strict input validation for the forward_url parameter or using a web application firewall (WAF) to filter malicious requests may reduce risk.