CVE-2023-1634
📋 TL;DR
This CVE describes a critical Server-Side Request Forgery (SSRF) vulnerability in OTCMS 6.72. Attackers can exploit the UseCurl function in /admin/info_deal.php to make the server send unauthorized requests to internal or external systems. All users running OTCMS 6.72 with the vulnerable component are affected.
💻 Affected Systems
- OTCMS
📦 What is this software?
Otcms by Otcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, perform port scanning of internal networks, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Information disclosure from internal services, potential data exfiltration, and unauthorized access to internal resources accessible from the vulnerable server.
If Mitigated
Limited impact if network segmentation restricts the vulnerable server's access to sensitive internal resources and external internet access is controlled.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires access to the admin interface or authentication bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or applying workarounds.
🔧 Temporary Workarounds
Restrict Access to Admin Interface
allLimit access to /admin/ directory to trusted IP addresses only
# Apache: <Location /admin> Require ip 192.168.1.0/24 </Location>
# Nginx: location /admin { allow 192.168.1.0/24; deny all; }
Disable Vulnerable Component
linuxRemove or rename the vulnerable info_deal.php file
mv /path/to/admin/info_deal.php /path/to/admin/info_deal.php.disabled
🧯 If You Can't Patch
- Implement strict network segmentation to limit the server's ability to reach internal resources
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if OTCMS version is 6.72 and if /admin/info_deal.php exists and is accessibleCheck Version:
Check OTCMS configuration files or admin panel for version informationVerify Fix Applied:
Verify the vulnerable file has been removed/renamed or access to /admin/ is properly restricted📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /admin/info_deal.php with URL parameters
- Outbound connections from the server to unexpected internal/external IPs
Network Indicators:
- Unexpected outbound HTTP requests from the OTCMS server to internal services
SIEM Query:
source="web_server" AND (uri="/admin/info_deal.php" OR uri CONTAINS "info_deal.php")