CVE-2023-27163

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

• CWE-918
• CWE-918

• http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html
• http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html
• https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3Exploit, Third Party Advisory
• https://github.com/darklynx/request-basketsProduct
• https://notes.sjtu.edu.cn/s/MUUhEymt7Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html
• http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html
• https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3Exploit, Third Party Advisory
• https://github.com/darklynx/request-basketsProduct
• https://notes.sjtu.edu.cn/s/MUUhEymt7Exploit, Third Party Advisory

Published

Mar 31, 2023

Last Modified

Jul 9, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27152DECISO OPNsense 23.1 does not impose rate limits for authent…9.8
• CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Sid…7.5
• CVE-2023-2716The Groundhogg plugin for WordPress is vulnerable to unautho…5.4
• CVE-2023-27160forem up to v2022.11.11 was discovered to contain a Server-S…7.2
• CVE-2023-27161Jellyfin up to v10.7.7 was discovered to contain a Server-Si…7.5
• CVE-2023-27162openapi-generator up to v6.4.0 was discovered to contain a S…9.1
• CVE-2023-27164An arbitrary file upload vulnerability in Halo up to v1.6.1 …4.8
• CVE-2023-27167Suprema BioStar 2 v2.8.16 was discovered to contain a SQL in…6.5
• CVE-2023-27168An arbitrary file upload vulnerability in Xpand IT Write-bac…9.8
• CVE-2023-27169Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in …6.5
• CVE-2023-2717The Groundhogg plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2023-27170Xpand IT Write-back manager v2.3.1 allows attackers to perfo…7.5