SSRF in Book Stack 23.10.2

This repository provides a Proof-of-Concept (PoC) exploit for PHP filter chain oracles, specifically targeting scenarios where an attacker can control input to a PHP stream wrapper (such as via SSRF or LFI) and observe error responses from the server. The exploit is based on research by Synacktiv and adapts their original OOP exploit into a more accessible, procedural Python script for CTF and real-world use. The main files are 'poc.py' (standard, function-wrapped version) and 'poc_procedure.py' (step-by-step, procedure-oriented version). Both scripts require the user to customize the 'req()' function to match the target application's request logic and endpoint. The exploit works by crafting complex PHP filter chains that, when processed by the server, cause observable errors (e.g., HTTP 500) depending on the contents of the target file, allowing the attacker to brute-force and reconstruct the file contents. The repository also includes PHP scripts in 'filters_playaround/' that demonstrate the encoding and filter manipulation logic. The exploit is relevant for CVE-2023-6199 (BookStack) and any PHP application vulnerable to filter chain oracles. No hardcoded targets are present; the scripts are templates requiring user adaptation for each scenario.

This repository provides a Python-based exploit tool for CVE-2023-6199, a vulnerability in BookStack (version 23.10.2) and potentially other PHP applications that allows attackers to read arbitrary files from the server using a PHP filter chain error-based oracle. The exploit works by sending crafted HTTP requests to a vulnerable endpoint, leveraging PHP's filter chain functionality to trigger error conditions that leak file contents, even when the server does not directly return the file data. The main entry point is 'filters_chain_oracle_exploit.py', which implements a CLI for specifying the target URL, file to leak, HTTP verb, headers, and other options. The core logic is modularized in the 'filters_chain_oracle/core/' directory, with components for request handling, brute-forcing the file content, and utility functions. The exploit is operational and can be used to extract sensitive files from affected servers, provided the attacker can reach a vulnerable endpoint and supply the necessary parameters (such as session or CSRF tokens). Example endpoints and file paths are provided in the README, and the tool supports advanced options such as proxying, custom headers, and time-based or pattern-based oracles.