.. / CVE-2022-24129

• SSRF
• Nuclei
• Web

Exploit for Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery (CVE-2022-24129)

Description:

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.

Nuclei Template

View the template here CVE-2022-24129.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-24129.yaml

References: