Cyber Resilience

CVE-2023-6199

MediumPublic PoC

Published: 20 November 2023

Published
20 November 2023
Modified
19 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.1338 94.3th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-6199 is a medium-severity SSRF (CWE-918) vulnerability in Bookstackapp Bookstack. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

BookStack version 23.10.2 is vulnerable to server-side request forgery (SSRF, CWE-918) that permits an attacker to filter and access local files on the underlying server. The flaw received a CVSS 3.1 score of 6.5, reflecting network attack vector, low complexity, and low-privileged credentials with high impact on confidentiality.

An authenticated user with low privileges can supply crafted requests that cause the application to retrieve or enumerate local resources, exposing sensitive file contents without requiring user interaction or elevated rights.

The official BookStack release notes for version 23.10.3 and the accompanying Fluid Attacks advisory indicate that the issue is resolved in the 23.10.3 update; administrators are advised to upgrade promptly to eliminate the SSRF vector.

EPSS for the CVE remains at 0.1338 with no material increase after disclosure.

EU & UK References

Vulnerability details

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

SSRF vulnerability (CVE-2023-6199) in Book Stack enables exploitation of a public-facing web application (T1190) and facilitates reading arbitrary local files on the server (LFR), mapping to data collection from the local system (T1005).

Affected Assets

bookstackapp
bookstack
23.10.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection
addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation
addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring
addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References