CVE-2024-22200

Executive Summary

CVE-2024-22200 is a low-severity information disclosure vulnerability affecting the vantage6-UI component of the vantage6 platform. The vulnerability allows an unauthenticated remote attacker to discover the exact version of nginx running behind the UI, due to the default Docker image configuration leaking the nginx version in HTTP response headers. While the CVSS score is 3.3 (Low), this information can be used by attackers to tailor further attacks against known nginx vulnerabilities. The vendor has patched this in version 4.2.0 by recommending users run the UI as an Angular application, which does not expose the nginx version.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but rather to a Docker image configuration. The supply chain risk is minimal, as the vulnerability is in the deployment configuration, not in a dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (nginx version disclosure)
• Integrity Impact: None
• Availability Impact: None

The threat level is low due to the limited impact (only version disclosure) and the lack of known active exploitation (EPSS 0.0%). However, in a targeted attack, this information can be used to identify vulnerable nginx versions.

Deep Dive & Mechanics

The vulnerability stems from the default configuration of the vantage6-UI Docker image. When the UI is served via nginx, the server header in HTTP responses includes the nginx version (e.g., nginx/1.21.6). This is a common misconfiguration where the server_tokens directive is not set to off in the nginx configuration.

The attack is trivial: an attacker sends an HTTP request to the vantage6-UI endpoint and inspects the Server header in the response. No authentication or special privileges are required.

The fix in version 4.2.0 involves running the UI as an Angular application, which typically uses a different serving mechanism (e.g., ng serve or a static file server) that does not expose the nginx version. Alternatively, users can manually configure nginx to hide the version by setting server_tokens off; in the nginx configuration.

Vulnerable vs. Patched Code

Vulnerable Configuration (Dockerfile or nginx config):

server {
    listen 80;
    server_name example.com;
    # Missing server_tokens off;
    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

Patched Configuration (Angular application or nginx with server_tokens off):

server {
    listen 80;
    server_name example.com;
    server_tokens off;
    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

Alternatively, running the UI as an Angular application:

ng serve --host 0.0.0.0 --port 80

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable vantage6-UI instance using Docker:

   docker run -d -p 8080:80 vantage6/vantage6-ui:4.1.0
   

2. Verify the vulnerability:

   curl -I http://localhost:8080
   

   Expected response header: Server: nginx/1.21.6

Exploitation:

• No exploit code is required. Simply inspect the HTTP response headers.
• Use the disclosed nginx version to search for known vulnerabilities (e.g., CVE-2023-44487 for HTTP/2 rapid reset).

Blue Team

Detection:

• Monitor for HTTP requests that specifically check the Server header.
• Look for unusual scanning patterns from IPs that probe for nginx version.

Hunting:

• Search logs for Server: nginx/ in response headers.
• Use the following Sigma rule to detect version disclosure.

Indicators of Compromise (IOCs)

• HTTP Response Header: Server: nginx/<version> (e.g., nginx/1.21.6)
• Source IPs: Any IP performing HTTP header inspection (common scanning tools like curl, nmap, nikto).
• User-Agent: May include curl, Go-http-client, or custom scanners.

Detection Engineering

YARA Rule

rule vantage6_nginx_version_disclosure {
    meta:
        description = "Detects nginx version disclosure in HTTP responses from vantage6-UI"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22200"
    strings:
        $nginx_version = /Server: nginx\/\d+\.\d+\.\d+/
    condition:
        $nginx_version
}

Sigma Rule

title: Nginx Version Disclosure via HTTP Response Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects nginx version disclosure in HTTP response headers from vantage6-UI
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22200
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        response_header: "Server: nginx/*"
    condition: selection
falsepositives:
    - Legitimate nginx servers with server_tokens enabled
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22200 - Nginx Version Disclosure from vantage6-UI"; flow:to_client; content:"Server: nginx/"; http_server; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to vantage6-UI version 4.2.0 or later.
2. Workaround: If upgrade is not possible, modify the nginx configuration to set server_tokens off; and restart nginx.
3. Alternative: Run the UI as an Angular application using ng serve instead of nginx.
4. Long-term: Implement a Web Application Firewall (WAF) to strip or modify server headers.
5. Monitoring: Enable logging of HTTP response headers and alert on any Server: nginx/ patterns.

Valters IT
Securing your digital frontier.