CVE-2024-12989

Executive Summary

CVE-2024-12989 is a server-side request forgery (SSRF) vulnerability in WISI Tangram GT31 devices up to firmware version 20241214. The flaw exists in the HTTP Request Handler component, allowing an unauthenticated remote attacker to make the device send crafted HTTP requests to internal or external systems. This can lead to information disclosure, internal network scanning, or further exploitation of internal services. The vendor has not responded to disclosure attempts, and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for exposed devices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify internal resources.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.3 (Medium)
Threat Level: Medium – Exploitation is straightforward but limited in impact.

Deep Dive & Mechanics

The WISI Tangram GT31 is a network device used for signal processing and distribution. The HTTP Request Handler component does not properly validate or sanitize user-supplied URLs when processing HTTP requests. An attacker can craft a request that forces the device to initiate an HTTP request to an arbitrary destination, including internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8) or external systems. This SSRF vulnerability can be used to:

• Scan internal network services.
• Access metadata endpoints (e.g., cloud instance metadata).
• Perform port scanning of internal hosts.
• Exploit other internal services that trust the device.

The vulnerability is classified as problematic due to the lack of authentication required and the potential for internal reconnaissance.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code likely lacks input validation on the url parameter in the HTTP request handler. A patched version would include:

• Whitelist-based validation of allowed destinations.
• Blocking of private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Restriction to only necessary external endpoints.

Exploitation & Lab Setup

Red Team

1. Identify Target: Use Shodan dorks to find exposed Tangram GT31 devices.
2. Craft SSRF Payload: Send a GET request to the vulnerable endpoint with a manipulated URL parameter.

   GET /handler?url=http://127.0.0.1:8080/admin HTTP/1.1
   Host: target-ip
   

3. Verify Response: If the device returns data from the internal service, the SSRF is successful.
4. Escalate: Use the SSRF to access cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/).

Blue Team

1. Monitor Outbound Connections: Alert on unexpected HTTP requests from the device to internal IPs or known cloud metadata IPs.
2. Network Segmentation: Place Tangram GT31 devices in isolated VLANs with strict egress filtering.
3. Web Application Firewall (WAF): Deploy rules to block requests containing private IP ranges in URL parameters.
4. Honeypot: Set up internal services that log and alert on unexpected connections from the device.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Outbound HTTP requests from the device to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (cloud metadata).
  • Unusual destination ports (e.g., 8080, 8443, 3306).
• Logs:
  • Device logs showing url parameter with internal IPs.
  • Repeated connection attempts to multiple internal hosts.
• File Hashes: N/A (no known malware associated).

Detection Engineering

YARA Rule

rule CVE_2024_12989_SSRF {
    meta:
        description = "Detects SSRF attempts against WISI Tangram GT31"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12989"
    strings:
        $url_param = "url=" nocase
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ nocase
        $cloud_meta = "169.254.169.254" nocase
    condition:
        $url_param and ($private_ip or $cloud_meta)
}

Sigma Rule

title: SSRF Attempt Against WISI Tangram GT31
id: 7a8b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to private IPs or cloud metadata from Tangram GT31
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "url="
        cs-uri-query|contains|all:
            - "127."
            - "10."
            - "172."
            - "192.168."
            - "169.254.169.254"
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12989 SSRF Attempt - Private IP in URL"; flow:to_server; content:"url="; nocase; pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the HTTP Request Handler if not required. Restrict network access to the device using firewall rules.
• Short-term: Monitor for SSRF attempts using the provided detection rules. Implement network segmentation.
• Long-term: Replace the device with a patched alternative or apply a vendor patch if released. Contact WISI for support.
• Compensating Controls: Use a reverse proxy to filter outbound requests from the device.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert