{"id":"CVE-2023-27163","aliases":["EUVD-2023-0880","GHSA-58g2-vgpg-335q"],"status":"published","title":"request-baskets vulnerable to Server-Side Request Forgery","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.06537,"percentile":0.9389,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2023-03-31T00:00:00Z","modified":"2026-10-28T02:30:36Z","exploits":[{"source":"pocgithub","id":"entr0pie/CVE-2023-27163","title":"entr0pie/CVE-2023-27163","date":"2023-07-11","url":"https://github.com/entr0pie/CVE-2023-27163"},{"source":"pocgithub","id":"seanrdev/cve-2023-27163","title":"seanrdev/cve-2023-27163","date":"2023-07-19","url":"https://github.com/seanrdev/cve-2023-27163"},{"source":"pocgithub","id":"overgrowncarrot1/CVE-2023-27163","title":"overgrowncarrot1/CVE-2023-27163","date":"2023-07-20","url":"https://github.com/overgrowncarrot1/CVE-2023-27163"},{"source":"pocgithub","id":"ThickCoco/CVE-2023-27163-POC","title":"ThickCoco/CVE-2023-27163-POC","date":"2023-07-26","url":"https://github.com/ThickCoco/CVE-2023-27163-POC"},{"source":"pocgithub","id":"davuXVI/CVE-2023-27163","title":"davuXVI/CVE-2023-27163","date":"2023-07-26","url":"https://github.com/davuXVI/CVE-2023-27163"},{"source":"pocgithub","id":"hhesenjan/CVE-2023-27163-AND-Mailtrail-v0.53","title":"hhesenjan/CVE-2023-27163-AND-Mailtrail-v0.53","date":"2023-08-05","url":"https://github.com/hhesenjan/CVE-2023-27163-AND-Mailtrail-v0.53"},{"source":"pocgithub","id":"rvzsec/CVE-2023-27163","title":"rvzsec/CVE-2023-27163","date":"2023-08-09","url":"https://github.com/rvzsec/CVE-2023-27163"},{"source":"pocgithub","id":"cowsecurity/CVE-2023-27163","title":"cowsecurity/CVE-2023-27163","date":"2023-08-13","url":"https://github.com/cowsecurity/CVE-2023-27163"},{"source":"pocgithub","id":"thomas-osgood/CVE-2023-27163","title":"thomas-osgood/CVE-2023-27163","date":"2023-08-13","url":"https://github.com/thomas-osgood/CVE-2023-27163"},{"source":"pocgithub","id":"samh4cks/CVE-2023-27163-InternalProber","title":"samh4cks/CVE-2023-27163-InternalProber","date":"2023-08-28","url":"https://github.com/samh4cks/CVE-2023-27163-InternalProber"},{"source":"pocgithub","id":"Hamibubu/CVE-2023-27163","title":"Hamibubu/CVE-2023-27163","date":"2023-09-21","url":"https://github.com/Hamibubu/CVE-2023-27163"},{"source":"pocgithub","id":"MasterCode112/CVE-2023-27163","title":"MasterCode112/CVE-2023-27163","date":"2023-12-28","url":"https://github.com/MasterCode112/CVE-2023-27163"},{"source":"pocgithub","id":"madhavmehndiratta/CVE-2023-27163","title":"madhavmehndiratta/CVE-2023-27163","date":"2024-01-06","url":"https://github.com/madhavmehndiratta/CVE-2023-27163"},{"source":"pocgithub","id":"Rishabh-Kumar-Cyber-Sec/CVE-2023-27163-ssrf-to-port-scanning","title":"Rishabh-Kumar-Cyber-Sec/CVE-2023-27163-ssrf-to-port-scanning","date":"2024-06-27","url":"https://github.com/Rishabh-Kumar-Cyber-Sec/CVE-2023-27163-ssrf-to-port-scanning"},{"source":"pocgithub","id":"btar1gan/exploit_CVE-2023-27163","title":"btar1gan/exploit_CVE-2023-27163","date":"2024-09-22","url":"https://github.com/btar1gan/exploit_CVE-2023-27163"},{"source":"pocgithub","id":"G4sp4rCS/htb-sau-automated","title":"G4sp4rCS/htb-sau-automated","date":"2025-04-02","url":"https://github.com/G4sp4rCS/htb-sau-automated"},{"source":"pocgithub","id":"lukehebe/CVE-2023-27163-POC","title":"lukehebe/CVE-2023-27163-POC","date":"2025-04-17","url":"https://github.com/lukehebe/CVE-2023-27163-POC"},{"source":"pocgithub","id":"J0ey17/Exploit_CVE-2023-27163","title":"J0ey17/Exploit_CVE-2023-27163","date":"2025-06-03","url":"https://github.com/J0ey17/Exploit_CVE-2023-27163"},{"source":"pocgithub","id":"theopaid/CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer","title":"theopaid/CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer","date":"2025-06-08","url":"https://github.com/theopaid/CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer"},{"source":"pocgithub","id":"thealchimist86/CVE-2023-27163---Maltrail-0.53---RCE","title":"thealchimist86/CVE-2023-27163---Maltrail-0.53---RCE","date":"2026-02-03","url":"https://github.com/thealchimist86/CVE-2023-27163---Maltrail-0.53---RCE"},{"source":"pocgithub","id":"thealchimist86/CVE-2023-27163---SSRF-Baskets-Requests","title":"thealchimist86/CVE-2023-27163---SSRF-Baskets-Requests","date":"2026-02-03","url":"https://github.com/thealchimist86/CVE-2023-27163---SSRF-Baskets-Requests"},{"source":"pocgithub","id":"tombstoneghost/htb-sau-exploit-chain","title":"tombstoneghost/htb-sau-exploit-chain","date":"2026-04-17","url":"https://github.com/tombstoneghost/htb-sau-exploit-chain"},{"source":"pocgithub","id":"Jeanback1/CVE-2023-27163-exploit","title":"Jeanback1/CVE-2023-27163-exploit","date":"2026-05-12","url":"https://github.com/Jeanback1/CVE-2023-27163-exploit"},{"source":"pocgithub","id":"AmulyaKaushik/CVE-2023-27163-lab","title":"AmulyaKaushik/CVE-2023-27163-lab","date":"2026-09-20","url":"https://github.com/AmulyaKaushik/CVE-2023-27163-lab"},{"source":"nuclei","id":"CVE-2023-27163","title":"Request-Baskets \u003c= 1.2.1 - Server Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27163.yaml"}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/darklynx/request-baskets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/darklynx/request-baskets","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.2.1"}]}]}],"products":[{"vendor":"rbaskets","product":"request_baskets"}],"references":[{"url":"https://notes.sjtu.edu.cn/s/MUUhEymt7","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/darklynx/request-baskets","tags":["x_transferred","Product","package"]},{"url":"https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27163","tags":["advisory"]},{"url":"http://request-baskets.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58g2-vgpg-335q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27163.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-27163","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T00:00:00Z","modified":"2026-07-09T00:24:32.884Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-0880","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T00:00:00Z","modified":"2026-07-09T00:24:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:06.781463Z"}],"ghsa":[{"id":"GHSA-58g2-vgpg-335q","title":"request-baskets vulnerable to Server-Side Request Forgery","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T21:30:39Z","modified":"2023-08-11T22:56:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2023-27163","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T20:15:07.477Z","modified":"2026-07-09T01:18:12.79Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"CVE-2023-27163","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T00:00:00Z","modified":"2026-10-28T02:30:36.070957488Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-58g2-vgpg-335q","title":"request-baskets vulnerable to Server-Side Request Forgery","description":"request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.","status":"published","published":"2023-03-31T21:30:39Z","modified":"2023-11-08T04:12:03.624692Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}