.. / CVE-2015-8813

Exploit for Umbraco <7.4.0- Server-Side Request Forgery (CVE-2015-8813)

Description:

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index.

Nuclei Template

View the template here CVE-2015-8813.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-8813.yaml
Copy

References:

https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/
https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce
http://www.openwall.com/lists/oss-security/2016/02/18/8
http://issues.umbraco.org/issue/U4-7457
https://nvd.nist.gov/vuln/detail/CVE-2015-8813