Sploitus

Exploit for CVE-2021-41277_SSRF

kitploit · 2026-09-10

Exploit Code

MARKDOWN36 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SASUKEOURAD-CVE-2021-41277_SSRF
# CVE-2021-41277_SSRF

CVE-2021-41277 can be extended to an SSRF

## Description

Metabase is an open source data analytics platform. **Metabase versions < 0.40.5** were affected by **CVE-2021-41277** which led to local file inclusion according to the CVE description.

While analyzing the finding described in Metabase Security Advisory and diffing the code, it seemed that it can be extended to an **SSRF** since URL Schemas were not filtered.

### POC || GTFO

First test is to try to call an external server. This would be successfully performed as shown below. A Metabase instance would call an external server. ![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/c82bdd44565cfa0303919390d7b6bb443551c7fc0670ffbf1a41828e46389586/602ae130b283799a586af3760d0c3511db7f6d2fad59e3bedcee2b31dcf2b14f-display-v1.webp)

Second test is to scan the internal network. It starts with making use of the LFI to identify the network:

![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/9a9581ae68dc0f27921f976227d6372313ac92009c1b242e159bd0a8d99929e0/06d18e9c4ddef5b9aa4eae4c90f1bc591ca8658ee646020ceb3906ecaa38d0ae-display-v1.webp)

Then, various IP addresses, ports can be probed to identify running services

![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/47256ba84de8d745f58311f1a824fea405bbd96c2a358e38085d55e21ab217c6/525ff02a5296e4e10c81da7f2e3345d059466e3dd3e261388e602e083ce4f0b1-display-v1.webp)

Third test is to use a different schema. FTP to the resque. This would work too. Though it is important to note that Metabase does a good job forcing the response Content-Type which avoids escalating this attack to an RCE.

![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/4e26e5f41e907d552e718e80e5da6c88f3c6706390f13de7e21dfae9f1e2fb86/74e91a5decba33a4616950764968a37e536a09558b16f9fa1d871775818ba4a2-display-v1.webp)

Finally, this vulnerability allows attackers to reach internal AWS, google cloud pages which can leak sensitive information as shown below:

![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/088e96c65f297bc3ea0279384eadf70b032ed6d47691535aa5f74720a5728415/97b64d158bb9bf1d2f843f8cc5d53fe496bf66069667ff5e2b77a89612f41e4e-display-v1.webp)

![IMAGE ALT TEXT HERE](https://assets.kitploit.com/production/public/readmes/52661/8dba8244f70fbb0aa165e1a5af3d4c2b2ffeb988ddddb507f22501f84bc50d43/e53792fc3fd5672a643d916d79bfa82e077b83bc763137d42153eb4dcfade50b-display-v1.webp)

#### Note!

This was responsibly disclosed to Metabase. I appreciate the response and professionalism of their security team.