ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)

ExploitDBExploitDB exploitScannerEDB-52434

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes an SSRF vulnerability in ClipBucket 5.5.2 and provides a single HTTP POST request as a PoC. The request sends a URL to the server, which will attempt to connect to the specified internal service, demonstrating the vulnerability. No code is provided to exploit the SSRF for further impact such as data exfiltration or internal pivoting; the request only triggers the server-side request to prove the vulnerability exists.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a plaintext description of an SSRF vulnerability in ClipBucket, including a single HTTP POST request as a proof-of-concept. The request uses a standard `file` parameter to target an internal service (127.0.0.1:3306). No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagestext
Target softwareClipBucket
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a single HTTP request that triggers a server-side request to a user-supplied URL, demonstrating the existence of the SSRF vulnerability. It does not include code to exploit the SSRF for further impact such as data exfiltration, internal pivoting, or command execution. The request itself only validates the vulnerability by causing the server to connect to an internal service, which is characteristic of a scanner/proof-of-concept rather than a full exploit.

exploits/multiple/remote/52434.txt:19-32

Requirements

  • An authenticated user session with regular permissions is required.exploits/multiple/remote/52434.txt:12
  • The target must be running ClipBucket 5.5.2 Build #90.exploits/multiple/remote/52434.txt:1

Observed behavior

  • Sends an HTTP POST request to /upload/actions/file_downloader.php with a file parameter containing a URL pointing to an internal service (127.0.0.1:3306).exploits/multiple/remote/52434.txt:21-26
  • The server attempts to connect to the internal service specified in the file parameter, demonstrating the SSRF vulnerability.exploits/multiple/remote/52434.txt:31-32
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://127.0.0.1:3306/test.mp4The PoC demonstrates SSRF by directing the server to make a request to an internal MySQL port, which is the stated vulnerability behavior.exploits/multiple/remote/52434.txt:26
Review boundaries

What the analysis did not establish

  • The artifact is a text writeup with a single HTTP request; no executable exploit code is provided.
  • The described impact (internal network enumeration, data exfiltration, pivoting) is not demonstrated by the supplied PoC request.
  • The CVE description mentions 'execute arbitrary codes' but the artifact only describes and demonstrates SSRF; no code execution mechanism is shown.
  • Only the supplied text file was reviewed; no external tools, libraries, or referenced resources were inspected.
  • The artifact is a plaintext description and PoC request; no executable code or binary content was present to analyze.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1