OneBlog v2.3.4 background SSRF vulnerability

## vulnerability Abstract

There are two SSRF vulnerabilities in OneBlog v2.3.4, one in adding friendly links and the other in the article porter function, which can be exploited by attackers to initiate probes on intranet services.

## Scope of influence
OneBlog v2.3.4

## vulnerability Reappearance
### The first SSRF vulnerability:

To log in to the system using the account password root/123456, click Lab-> Article Porter Module
![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/002815_1e324912_9153665.png "屏幕截图.png")
Vulnerability parameter：entryUrls

We can use python to set up a HTTP service as the target server，Judge whether the service is enabled according to the response result of the server accessing the target URL

This vulnerability can realize the function of intranet port detection, access different ports, open echoes will be different

If the port is open, it will take more than a thousand Millisecond

![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/002919_fbb3383c_9153665.png "屏幕截图.png")
If the port is shut down, it will take more than two thousand Millisecond，You can see that if the service is not enabled, the request takes almost twice as long.
![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/002936_9a5c5343_9153665.png "屏幕截图.png")
The request record for the HTTP server is as follows:
![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/002958_09f818c8_9153665.png "屏幕截图.png")
### The second SSRF vulnerability

After logging in, click website Management-> Link module, add a link, and enter the URL of the test at the Logo parameter.Click Save，When saving, a request will be made to the target URL
![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/003047_58d534da_9153665.png "屏幕截图.png")
Then refreshing the link will also request the target URL.

Then check the access record of the HTTP service
![输入图片说明](https://images.gitee.com/uploads/images/2022/0615/003103_f36bd679_9153665.png "屏幕截图.png")

yadong.zhang/OneBlog

内容风险标识

评论 (2)

yadong.zhang/OneBlog .gitee-modal { width: 500px !important; }

内容风险标识