Blind SSRF Vulnerability in Karlomikus Bar Assistant
CVE-2023-49471

8.8HIGH

Key Information:

Vendor

Karlomikus

Status
Bar Assistant
Vendor
CVE Published:
10 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-49471?

A vulnerability exists in Karlomikus Bar Assistant that allows an authenticated remote attacker to exploit a Blind Server-Side Request Forgery (SSRF) flaw. This issue arises due to inadequate validation of a parameter before issuing a request via the Image::make() function. By leveraging this vulnerability, attackers can potentially execute arbitrary code on the server, which emphasizes the critical need for robust input validation mechanisms in web applications to safeguard against unauthorized actions and enhance overall security.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-49471
Created by zunak

References

https://github.com/zunak/CVE-2023-49471

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.