CVE-2024-28435
Executive Summary
CVE-2024-28435 identifies a Server-Side Request Forgery (SSRF) vulnerability in the Twenty CRM platform, version 0.3.0. The flaw exists in the file upload functionality, allowing an unauthenticated attacker to trick the server into making internal or external HTTP requests. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS IMDS), or further exploitation of internal services. No official patch has been released, and the CVSS score is currently unassigned. The vulnerability is publicly documented with proof-of-concept code available.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Twenty CRM is a Node.js application. The SSRF vulnerability originates from insufficient validation of URLs provided during file uploads. This does not directly affect the npm supply chain, but the lack of a patch means organizations using this version must implement compensating controls.
CVSS Breakdown & Threat Level
- CVSS Score: 0.0 (Unassigned)
- Attack Vector (AV): Network
- Attack Complexity (AC): Low
- Privileges Required (PR): None
- User Interaction (UI): None
- Scope (S): Unchanged
- Confidentiality (C): High
- Integrity (I): Low
- Availability (A): None
Threat Level: High – SSRF can lead to data exfiltration and lateral movement.
Deep Dive & Mechanics
The vulnerability resides in the file upload endpoint. When a user uploads a file, the application processes a URL parameter to fetch the file from an external source. The application fails to validate or sanitize the URL, allowing an attacker to supply internal addresses (e.g., http://169.254.169.254/latest/meta-data/) or other arbitrary endpoints. The server then makes an HTTP request to the attacker-controlled URL, returning the response to the attacker.
Root Cause: Lack of URL validation and missing allowlist for outbound requests.
Vulnerable vs. Patched Code
Vulnerable Code (Twenty 0.3.0):
// fileUpload.js
const url = req.body.url;
const response = await axios.get(url);
// process response...
Patched Code (Hypothetical):
// fileUpload.js
const url = req.body.url;
const allowedHosts = ['trusted-cdn.example.com'];
const parsedUrl = new URL(url);
if (!allowedHosts.includes(parsedUrl.hostname)) {
throw new Error('URL not allowed');
}
const response = await axios.get(url);
// process response...
Exploitation & Lab Setup
Red Team
Lab Setup:
- Deploy Twenty CRM 0.3.0 in a Docker container.
- Set up a listener (e.g.,
nc -lvnp 4444) to capture outbound requests. - Use the following exploit to trigger SSRF:
curl -X POST http://target:3000/api/files/upload \
-H "Content-Type: application/json" \
-d '{"url":"http://169.254.169.254/latest/meta-data/"}'
Expected Outcome: The server fetches the AWS metadata endpoint and returns the response to the attacker.
Blue Team
Detection:
- Monitor outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).
- Alert on file upload requests containing suspicious URLs.
Mitigation:
- Implement a web application firewall (WAF) rule to block requests to private IPs.
- Restrict outbound traffic from the application server using network policies.
Indicators of Compromise (IOCs)
- Network: Outbound HTTP requests to
169.254.169.254,10.x.x.x,172.x.x.x,192.168.x.x. - Logs: File upload logs containing URLs with internal IPs or cloud metadata endpoints.
- File: Unexpected files in the upload directory originating from internal services.
Detection Engineering
YARA Rule
rule CVE_2024_28435_SSRF {
meta:
description = "Detects SSRF attempts via file upload URL in Twenty CRM"
author = "Valters IT"
date = "2024-03-15"
strings:
$url_pattern = /(http|https):\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/
condition:
$url_pattern
}
Sigma Rule
title: SSRF via File Upload in Twenty CRM
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts targeting internal IPs via file upload
logsource:
category: webserver
product: twenty
detection:
selection:
cs-uri-query|contains:
- '169.254.169.254'
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.20.'
- '172.21.'
- '172.22.'
- '172.23.'
- '172.24.'
- '172.25.'
- '172.26.'
- '172.27.'
- '172.28.'
- '172.29.'
- '172.30.'
- '172.31.'
- '192.168.'
condition: selection
falsepositives:
- Legitimate internal file transfers (rare)
level: high
Suricata Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"CVE-2024-28435 SSRF Attempt via File Upload";
flow:to_server;
content:"POST"; http_method;
content:"/api/files/upload"; http_uri;
content:"url"; http_client_body;
pcre:"/(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/";
sid:1000001;
rev:1;
)
Remediation & Mitigation
- Immediate: Disable file upload functionality if not required.
- Short-term: Implement a WAF rule to block requests to private IPs and cloud metadata endpoints.
- Long-term: Apply input validation to restrict URLs to an allowlist of trusted domains. Use a dedicated URL parser to reject internal IPs.
- Network: Restrict outbound traffic from the application server using firewall rules or egress filtering.
- Monitor: Enable logging and alerting on file upload activities.
Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation is illegal.