CVE-2024-25864

Executive Summary

CVE-2024-25864 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in Friendica, a decentralized social networking platform. The flaw resides in the fpostit.php component and affects all versions released after v.2023.12. An unauthenticated remote attacker can exploit this vulnerability to force the server to make arbitrary HTTP requests to internal or external resources, potentially leading to remote code execution (RCE) and sensitive information disclosure. The vulnerability has a CVSS score of 0.0 in the NVD database, but based on enriched threat intelligence and the nature of SSRF, the actual risk is severe. No public proof-of-concept (PoC) code or exploit is available at this time, but the attack surface is significant due to the lack of input validation on the fpostit.php endpoint.

Supply Chain & Package Security

Friendica is a PHP-based application. The vulnerability is not in a third-party package but in the core application code. However, the SSRF vector could be used to probe internal services, including databases, caching layers, or cloud metadata endpoints, which may expose credentials or tokens used in the supply chain. No specific package dependency is directly implicated.

CVSS Breakdown & Threat Level

While the NVD CVSS score is listed as 0.0 (likely due to incomplete analysis), the actual threat level is critical. Based on the SSRF nature and potential for RCE, the following CVSS vector is assessed:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Sensitive data can be exfiltrated.
• Integrity (I): High (H) – Arbitrary data can be written or modified.
• Availability (A): High (H) – Service disruption possible.

Assessed CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows an attacker to bypass network segmentation, access internal services, and potentially execute arbitrary code on the server.

Deep Dive & Mechanics

The vulnerability exists in the fpostit.php component. This endpoint is used for posting content to external services (e.g., cross-posting to other platforms). The flaw is that the application does not properly validate or sanitize the URL provided by the user before making an HTTP request to that URL.

Mechanism:

1. An attacker sends a crafted HTTP request to fpostit.php with a malicious url parameter.
2. The server-side PHP code uses a function like file_get_contents(), curl_exec(), or similar to fetch the content from the attacker-supplied URL.
3. Because the URL is not validated against a whitelist or checked for internal IP ranges, the attacker can specify:
   • http://127.0.0.1:3306 (MySQL database)
   • http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint)
   • file:///etc/passwd (local file inclusion via SSRF)
4. The server then makes the request, and the response is reflected back to the attacker or used in a way that leaks data.

Potential Impact:

• Information Disclosure: Access to internal services, cloud metadata, and configuration files.
• Remote Code Execution: If the attacker can chain the SSRF with a service that allows command injection (e.g., a vulnerable internal web app or a database with weak credentials).
• Network Scanning: The attacker can use the server as a proxy to scan internal networks.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the fpostit.php file. A typical vulnerable pattern would be:

Vulnerable Code (PHP):

<?php
// fpostit.php - VULNERABLE
$url = $_GET['url'];
$content = file_get_contents($url);
echo $content;
?>

Patched Code (Hypothetical):

<?php
// fpostit.php - PATCHED
$url = $_GET['url'];
$allowed_hosts = ['example.com', 'social.example.org'];
$parsed_url = parse_url($url);
if (!in_array($parsed_url['host'], $allowed_hosts)) {
    die('Invalid URL');
}
// Also check for internal IPs
if (filter_var($parsed_url['host'], FILTER_VALIDATE_IP) && !filter_var($parsed_url['host'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    die('Internal IP not allowed');
}
$content = file_get_contents($url);
echo $content;
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Friendica instance running version 2023.12 or later.
• Attacker: Kali Linux or any system with curl/netcat.
• Internal Service: A simple HTTP server on the same network (e.g., python3 -m http.server 8080).

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/fpostit.php?url=.
2. Test basic SSRF:

   curl "http://target/fpostit.php?url=http://127.0.0.1:80/"
   

3. Probe internal services:

   curl "http://target/fpostit.php?url=http://192.168.1.1:8080/admin"
   

4. Access cloud metadata (if on cloud):

   curl "http://target/fpostit.php?url=http://169.254.169.254/latest/meta-data/"
   

5. Attempt to read local files (if allow_url_fopen is enabled):

   curl "http://target/fpostit.php?url=file:///etc/passwd"
   

Note: No public exploit code is available. The above is a generic SSRF exploitation technique.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor logs for unusual outbound HTTP requests from the web server to internal IPs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
2. Look for requests to fpostit.php with a url parameter containing IP addresses or unusual schemes (e.g., file://, gopher://).
3. Alert on any access to cloud metadata endpoints (169.254.169.254).
4. Use the YARA and Sigma rules below to scan files and logs.

Mitigation Steps:

• Immediately restrict outbound traffic from the web server using a firewall or iptables.
• Apply a virtual patch using a WAF (Web Application Firewall) to block requests to fpostit.php with suspicious url parameters.
• Disable the fpostit.php endpoint if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the web server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (cloud metadata).
  • Requests to file:// or gopher:// schemes.
• File IOCs:
  • Suspicious entries in web server access logs containing fpostit.php?url=.
  • Unexpected files in /tmp/ or /var/www/ that may have been written via SSRF.
• Process IOCs:
  • Web server processes (e.g., apache2, nginx) making connections to internal services.

Detection Engineering

YARA Rule

rule CVE_2024_25864_SSRF_Friendica {
    meta:
        description = "Detects SSRF exploitation attempts against Friendica fpostit.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-25864"
    strings:
        $fpostit = "fpostit.php" nocase
        $url_param = "url=" nocase
        $internal_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ nocase
        $cloud_metadata = "169.254.169.254" nocase
        $file_scheme = "file://" nocase
    condition:
        $fpostit and $url_param and ($internal_ip or $cloud_metadata or $file_scheme)
}

Sigma Rule

title: CVE-2024-25864 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against Friendica fpostit.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "fpostit.php?url="
    filter:
        cs-uri-query|contains:
            - "http://"
            - "https://"
    condition: selection and not filter
falsepositives:
    - Legitimate cross-posting to allowed external services
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25864 SSRF Attempt - Friendica fpostit.php"; flow:to_server,established; content:"fpostit.php"; http_uri; content:"url="; http_uri; pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the fpostit.php endpoint if not required. This can be done by renaming or removing the file, or by configuring the web server to deny access to it.
2. Apply a WAF rule to block requests containing fpostit.php?url= with internal IPs or suspicious schemes.
3. Restrict outbound traffic from the web server using a firewall. Only allow connections to known, trusted external services.

Long-Term Fix:

• The vendor (Friendica) must release a patch that implements proper URL validation, including:
  • Whitelist of allowed external hosts.
  • Blocking of private IP ranges and loopback addresses.
  • Disabling dangerous URL schemes (e.g., file://, gopher://).
• Until a patch is available, consider upgrading to a version that does not include the vulnerable code, or apply the hypothetical patch shown above.

Workaround:

• If the endpoint is essential, implement a proxy that validates URLs before forwarding requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert