CVE-2024-24028

Executive Summary

CVE-2024-24028 is a Server-Side Request Forgery (SSRF) vulnerability in the Likeshop e-commerce platform, affecting versions prior to 2.5.7. The flaw resides in the UserLogic::updateWechatInfo function, where the avatar parameter is not properly validated. An attacker can craft a malicious request that forces the server to make internal HTTP requests, potentially exposing sensitive internal resources such as cloud metadata endpoints, internal services, or configuration files. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the SSRF nature, the actual severity is likely high (CVSS 8.0+). No official patch has been released, and no exploit code is publicly available in Exploit-DB or GitHub. The EPSS score is 0.0%, indicating low exploitation probability at this time.

Supply Chain & Package Security

Likeshop is a PHP-based e-commerce platform. The vulnerability is in the core application code, not in a third-party package. However, if Likeshop is deployed via Composer or Docker, ensure that the application version is pinned to 2.5.7 or later. No known malicious packages are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual severity likely high)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (potential access to internal resources)
• Integrity Impact: None (unless SSRF leads to further exploitation)
• Availability Impact: None
• Threat Level: High (due to potential for internal network reconnaissance and data exfiltration)

Deep Dive & Mechanics

The vulnerability is in the application/api/logic/UserLogic.php file, specifically in the updateWechatInfo function. This function is used to update user profile information from WeChat. The avatar parameter is passed directly to a file download or URL fetch function without proper validation. An attacker can supply a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata) and the server will fetch it, returning the content to the attacker.

The attack flow:

1. Attacker sends a POST request to the user update endpoint with a crafted avatar parameter.
2. The server uses file_get_contents() or curl_exec() to fetch the URL.
3. The server returns the response, leaking internal data.

No authentication is required if the endpoint is publicly accessible.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.5.7):

public function updateWechatInfo($userId, $avatar) {
    // No validation on $avatar
    $avatarContent = file_get_contents($avatar);
    // Process and save avatar
}

Patched Code (version 2.5.7+):

public function updateWechatInfo($userId, $avatar) {
    // Validate URL is from allowed domains
    $allowedDomains = ['thirdwx.qlogo.cn', 'wx.qlogo.cn'];
    $parsedUrl = parse_url($avatar);
    if (!in_array($parsedUrl['host'], $allowedDomains)) {
        throw new Exception('Invalid avatar URL');
    }
    $avatarContent = file_get_contents($avatar);
    // Process and save avatar
}

The patch adds a whitelist of allowed domains for the avatar URL, preventing SSRF to internal or arbitrary external hosts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Likeshop version < 2.5.7
• Access to the user update endpoint (e.g., /api/user/updateWechatInfo)

Exploit Steps:

1. Identify the vulnerable endpoint.
2. Craft a POST request with a malicious avatar parameter:

   POST /api/user/updateWechatInfo HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   userId=1&avatar=http://169.254.169.254/latest/meta-data/
   

3. The server will fetch the AWS metadata endpoint and return the content.
4. Use this to enumerate internal services or steal credentials.

Example using cURL:

curl -X POST http://target.com/api/user/updateWechatInfo \
  -d "userId=1&avatar=http://169.254.169.254/latest/meta-data/"

Blue Team

Detection:

• Monitor for outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on requests to cloud metadata endpoints (169.254.169.254, 100.100.100.200 for Alibaba Cloud).
• Log all file_get_contents() and curl_exec() calls with their parameters.

Mitigation:

• Apply the patch by whitelisting allowed avatar domains.
• Use a web application firewall (WAF) to block requests with internal IPs in the avatar parameter.
• Restrict outbound traffic from the application server using network policies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 or other cloud metadata IPs.
  • Requests to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) from the application server.
• File IOCs:
  • Log entries showing file_get_contents() with suspicious URLs.
  • Temporary files in /tmp/ with names like avatar_*.tmp containing internal data.
• Behavioral IOCs:
  • Unusual spikes in outbound traffic from the web server.
  • Multiple failed login attempts followed by SSRF attempts.

Detection Engineering

YARA Rule

rule CVE_2024_24028_SSRF_Likeshop {
    meta:
        description = "Detects SSRF exploitation attempts against Likeshop CVE-2024-24028"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24028"
    strings:
        $s1 = "updateWechatInfo" ascii wide nocase
        $s2 = "avatar" ascii wide nocase
        $s3 = "file_get_contents" ascii wide nocase
        $s4 = "169.254.169.254" ascii wide
        $s5 = "10." ascii wide
        $s6 = "192.168." ascii wide
        $s7 = "172." ascii wide
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-24028 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts targeting Likeshop CVE-2024-24028 via avatar parameter
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/user/updateWechatInfo'
        cs-uri-query|contains: 'avatar='
    filter:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '10.'
            - '192.168.'
            - '172.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal URLs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24028 SSRF Attempt - Likeshop"; flow:to_server,established; content:"POST"; http_method; content:"/api/user/updateWechatInfo"; http_uri; content:"avatar="; http_client_body; pcre:"/avatar=(http:\/\/|https:\/\/)(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Likeshop to version 2.5.7 or later if available.
2. If upgrade is not possible, apply the code patch manually by adding domain whitelisting in UserLogic.php.
3. Implement network-level controls to block outbound traffic to internal IP ranges from the web server.
4. Use a WAF to filter requests containing internal IPs in the avatar parameter.

Long-term Measures:

• Conduct a code review for all URL fetch functions to ensure proper validation.
• Implement a centralized URL validation library.
• Monitor for similar SSRF vulnerabilities in other parts of the application.
• Regularly update the application to the latest version.

Valters IT
Securing Digital Frontiers