CVE-2022-28117

MEDIUMNuclei

Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-28117 has a selected CVSS score of 4.9 (medium); EIP currently links 1 catalogued exploit, 2 repository PoCs, and 1 Nuclei template.

Description

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
2
Nuclei templates
1

Proofs of concept

3

Catalogued exploits

ExploitDBNavigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)ExploitDB exploitby cheshireca7Not analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubcheshireca7/CVE-2022-28117Repository PoCby cheshireca72Not analyzed2 files

4.1 KiB

GitHub
PoC details
GitHubkimstars/POC-CVE-2022-28117Repository PoCby kimstars0Not analyzed2 files

3.6 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMNavigate CMS 2.9.4 - Server-Side Request ForgeryCVSS 4.9

Navigate CMS 2.9.4 is susceptible to server-side request forgery via feed_parser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data modification, and/or unauthorized operation execution.

Impact

An attacker can exploit this vulnerability to bypass security controls, access internal resources, and potentially perform further attacks.

Remediation

Upgrade to a patched version of Navigate CMS or apply the vendor-provided patch to mitigate the SSRF vulnerability.

WeaknessesCWE-918
Authorstheabhinavgaur
Template tagscvecve2022authenticatedpacketstormssrfnavigatecmslfiintrusivenaviwebsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CPE: cpe:2.3:a:naviwebs:navigate_cms:2.9.4:*:*:*:*:*:*:*
https://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5 https://www.youtube.com/watch?v=4kHW95CMfD0 https://nvd.nist.gov/vuln/detail/CVE-2022-28117 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4