CVE-2023-53893
MEDIUMAteme TITAN File 3.9.12.4 - Authenticated Server-Side Request Forgery via Job Callback URL Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-53893. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates an authenticated SSRF vulnerability in Ateme TITAN File software, allowing an attacker to force the application to make arbitrary HTTP/DNS/File requests via a crafted callback URL parameter. The provided curl command shows file enumeration via a file:// URI.
Description
Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.
Exploits (1)
This exploit demonstrates an authenticated SSRF vulnerability in Ateme TITAN File software, allowing an attacker to force the application to make arbitrary HTTP/DNS/File requests via a crafted callback URL parameter. The provided curl command shows file enumeration via a file:// URI.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N