Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-7652. PoCs published by Alexandre Basquin.
AI-analyzed exploit summary This is a writeup describing an SSRF vulnerability in Cortex Unshortenlink Analyzer versions prior to 1.1. The exploit involves creating a new analysis with a malicious URL to trigger an SSRF, allowing interaction with internal services.
Description
TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.
Exploits (1)
This is a writeup describing an SSRF vulnerability in Cortex Unshortenlink Analyzer versions prior to 1.1. The exploit involves creating a new analysis with a malicious URL to trigger an SSRF, allowing interaction with internal services.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N