CVE-2024-13029

Executive Summary

CVE-2024-13029 is a Server-Side Request Forgery (SSRF) vulnerability identified in Antabot White-Jotter, a content management system, up to version 0.2.2. The flaw resides in the /admin/content/book endpoint, specifically within the "Edit Book Handler" function. An authenticated attacker can manipulate the handler to make the server send crafted requests to internal or external resources, potentially leading to information disclosure or further network attacks. The vulnerability has a CVSS score of 0.0 (placeholder) but is classified as problematic with a public exploit available. No official patch has been released, and the vendor status is unknown.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) and is specific to the White-Jotter application source code. No supply chain implications are identified.

CVSS Breakdown & Threat Level

The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating:

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs admin-level access to the /admin/content/book endpoint.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – the vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – limited information disclosure possible.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no impact on availability.

Threat Level: Medium. While the CVSS base score is low due to required privileges, the SSRF can be chained with other vulnerabilities (e.g., internal network scanning, cloud metadata access) to escalate impact.

Deep Dive & Mechanics

The vulnerability exists in the Edit Book Handler of the /admin/content/book endpoint. The application likely accepts a URL or file path parameter to fetch book cover images or metadata. Due to insufficient validation, an attacker can supply a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) that the server will fetch and return.

Root Cause: The application does not sanitize or restrict the URL input, allowing requests to internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16) or arbitrary external hosts.

Attack Flow:

1. Attacker authenticates to the admin panel.
2. Navigates to the "Edit Book" functionality.
3. Injects a malicious URL into the cover image or similar field.
4. Server processes the request and returns the response to the attacker.
5. Attacker can read internal resources, perform port scanning, or exploit cloud metadata endpoints.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the handler that processes the URL input. A patched version would include input validation and allowlisting of allowed domains or IP ranges.

Vulnerable Code (Conceptual):

# Vulnerable handler
def edit_book(request):
    cover_url = request.POST.get('cover_url')
    response = requests.get(cover_url)  # No validation
    return HttpResponse(response.content)

Patched Code (Conceptual):

# Patched handler
import re
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['example.com', 'images.example.com']

def edit_book(request):
    cover_url = request.POST.get('cover_url')
    parsed = urlparse(cover_url)
    if parsed.hostname not in ALLOWED_DOMAINS:
        return HttpResponseForbidden("Invalid URL")
    response = requests.get(cover_url)
    return HttpResponse(response.content)

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to White-Jotter admin panel (version <= 0.2.2).
• Knowledge of the /admin/content/book endpoint.

Exploit Steps:

1. Log in to the admin panel.
2. Navigate to the "Edit Book" section.
3. In the "Cover URL" or similar field, enter a malicious URL, e.g., http://127.0.0.1:8080/admin to probe internal services.
4. Submit the form and observe the response for leaked data.

Example Payloads:

• http://169.254.169.254/latest/meta-data/ (AWS metadata)
• file:///etc/passwd (if file protocol is supported)
• http://192.168.1.1:80 (internal network scanning)

No Exploit-DB code provided.

Blue Team (Defensive)

Detection:

• Monitor outbound HTTP requests from the server to unexpected IP ranges (e.g., private IPs, cloud metadata endpoints).
• Log all requests to /admin/content/book and inspect the cover_url parameter.

Mitigation:

• Implement strict input validation and allowlisting of URLs.
• Use a proxy or firewall to block outbound requests to private IP ranges.
• Apply the principle of least privilege to the admin panel.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
• File IOCs:
  • Log entries containing cover_url with suspicious URLs.
• Behavioral IOCs:
  • Unusual server response times due to internal network scanning.

Detection Engineering

YARA Rule

rule CVE_2024_13029_SSRF {
    meta:
        description = "Detects SSRF attempts in White-Jotter /admin/content/book"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13029"
    strings:
        $url_pattern = /(http|https):\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/ nocase
        $admin_path = "/admin/content/book"
    condition:
        $admin_path and $url_pattern
}

Sigma Rule

title: CVE-2024-13029 SSRF Attempt in White-Jotter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts via the /admin/content/book endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/content/book'
        cs-uri-query|contains: 'cover_url'
    filter:
        cs-uri-query|contains:
            - 'http://127.0.0.1'
            - 'http://10.'
            - 'http://172.16.'
            - 'http://172.17.'
            - 'http://172.18.'
            - 'http://172.19.'
            - 'http://172.20.'
            - 'http://172.21.'
            - 'http://172.22.'
            - 'http://172.23.'
            - 'http://172.24.'
            - 'http://172.25.'
            - 'http://172.26.'
            - 'http://172.27.'
            - 'http://172.28.'
            - 'http://172.29.'
            - 'http://172.30.'
            - 'http://172.31.'
            - 'http://192.168.'
            - 'http://169.254.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13029 SSRF Attempt - White-Jotter"; flow:to_server,established; content:"POST"; http_method; content:"/admin/content/book"; http_uri; content:"cover_url"; http_client_body; pcre:"/(http|https):\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /admin/content/book endpoint if not required.
2. Restrict outbound network access from the application server using a firewall or egress proxy.
3. Implement input validation to allow only trusted domains for URL parameters.

Long-Term Fix:

• Apply a patch from the vendor when available (currently UNKNOWN).
• Upgrade to a newer version of White-Jotter if released.
• Conduct a code review to ensure all URL inputs are sanitized.

Workaround:

• Modify the application code to block requests to private IP ranges and cloud metadata endpoints.

Valters IT