Description
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 24 repositories · most starred shown
-
entr0pie/CVE-2023-27163 ★ 32 · Jul 11, 2023
Proof-of-Concept for Server Side Request Forgery (SSRF) in request-baskets (<= v.1.2.1)
-
samh4cks/CVE-2023-27163-InternalProber ★ 5 · Aug 28, 2023
A tool to perform port scanning using vulnerable Request-Baskets
-
seanrdev/cve-2023-27163 ★ 4 · Jul 19, 2023
To assist in enumerating the webserver behind the webserver SSRF CVE-2023-27163
-
lukehebe/CVE-2023-27163-POC ★ 2 · Apr 17, 2025
CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network…
-
MasterCode112/CVE-2023-27163 ★ 2 · Dec 28, 2023
Proof of Concept for Server Side Request Forgery (SSRF) in request-baskets (V<= v.1.2.1)
-
thomas-osgood/CVE-2023-27163 ★ 2 · Aug 13, 2023
Golang PoC for CVE-2023-27163 Mailtrail Exploit
-
rvzsec/CVE-2023-27163 ★ 2 · Aug 9, 2023
CVE-2023-27163 - Request Baskets SSRF
-
hhesenjan/CVE-2023-27163-AND-Mailtrail-v0.53 ★ 2 · Aug 5, 2023
Requests Baskets (CVE-2023-27163) and Mailtrail v0.53
-
davuXVI/CVE-2023-27163 ★ 1 · Jul 26, 2023
PoC CVE-2023-27163, SSRF, request-baskets hasta v1.2.1
-
ThickCoco/CVE-2023-27163-POC ★ 1 · Jul 26, 2023
Poc of SSRF for Request-Baskets (CVE-2023-27163)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Request-Baskets <= 1.2.1 - Server Side Request Forgery http/cves/2023/CVE-2023-27163.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/darklynx/request-baskets | <= 1.2.1 | — | GHSA-58g2-vgpg-335q |
References
- https://notes.sjtu.edu.cn/s/MUUhEymt7
- https://github.com/darklynx/request-baskets
- https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3
- http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html