CVE-2019-8982
published 2019-02-21CVE-2019-8982: com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of…
PriorityP178critical9.6CVSS 3.0
AVNACLPRNUIRSCCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
25.56%
97.7th percentile
com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wavemaker | wavemarker_studio | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring HTTP GET requests to the path /wavemaker/studioService.download with query parameters method=getContent and inUrl= containing file:// or http:// schemes, indicating LFI or SSRF abuse. ↗
- →Flag responses containing Unix /etc/passwd content (matching root:.*:0:0:) in the HTTP response body as successful LFI exploitation. ↗
- →The vulnerable parameter is inUrl passed to the getContent() method in StudioService.java; any user-supplied URL (file://, http://, etc.) is fetched server-side without validation. ↗
- →Monitor for inUrl values using the file:// scheme (e.g., file///etc/passwd, file///etc/shadow) to detect local file inclusion attempts against WaveMaker Studio 6.6. ↗
- ·The affected version is strictly WaveMaker Studio 6.6; detections and mitigations should be scoped to this version. ↗
CVSS provenance
nvdv3.09.6CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck9.6CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xq3x-7w9j-26jf: com/wavemaker/studio/StudioService
ghsa_unreviewed·2022-05-14
CVE-2019-8982 [CRITICAL] CWE-918 GHSA-xq3x-7w9j-26jf: com/wavemaker/studio/StudioService
com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
VulnCheck
wavemaker wavemarker_studio Server-Side Request Forgery (SSRF)
vulncheck·2019·CVSS 9.6
CVE-2019-8982 [CRITICAL] wavemaker wavemarker_studio Server-Side Request Forgery (SSRF)
wavemaker wavemarker_studio Server-Side Request Forgery (SSRF)
com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
Affected: wavemaker wavemarker_studio
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024; https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip; https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389
No detection rules found.
Exploit-DB
Wavemaker Studio 6.6 - Server-Side Request Forgery
exploitdb·2018-08-06
CVE-2019-8982 Wavemaker Studio 6.6 - Server-Side Request Forgery
Wavemaker Studio 6.6 - Server-Side Request Forgery
---
# Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF).
# Exploit Author: Gionathan "John" Reale
# Google Dork: N/A
# Date: 2018-08-01
# Vendor Homepage: http://www.wavemaker.com/
# Software Link: https://github.com/cloudjee/wavemaker/blob/master/wavemaker/wavemaker-studio/
# Affected Version: 6.6
# Tested on: Parrot OS
# CVE : 2019-8982
# Description
# Wavemaker Studio 6.6 contains an exploitable unvaildated parameter allowing an
# attacker to pass dangerous content to a victim via a phishing link. The vulnerability
# can also be exploited to access sensitive data or to use the server hosting Wavemaker
# as a form of HTTP proxy among other things.
# Proof Of Concept
http://xxxx.xxxxx:xxxx/wavemaker/studioServic
Nuclei
Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery
nuclei·CVSS 9.6
CVE-2019-8982 [CRITICAL] Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery
Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery
WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery.
Template:
id: CVE-2019-8982
info:
name: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery
author: madrobot
severity: critical
description: "WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery."
impact: |
Successful exploitation of these vulnerabilities could lead to unauthorized access to sensitive files and potential server-side request forgery
2019-02-21
Published
Exploited in the wild