CVE-2024-37164

Executive Summary

CVE-2024-37164 is a Server-Side Request Forgery (SSRF) vulnerability in the Computer Vision Annotation Tool (CVAT), an open-source interactive video and image annotation platform. The flaw resides in the custom cloud storage endpoint feature, which allows authenticated users to specify arbitrary URLs for Amazon S3 and Azure Blob Storage integrations. An attacker with a valid CVAT account can exploit this by providing URLs pointing to internal network IP addresses or domain names. This enables the attacker to probe the internal network for HTTP(S) servers, and if a server is sufficiently API-compatible with S3 or Azure Blob Storage, they may be able to list, extract, or overwrite files on that internal server. The vulnerability affects CVAT versions 2.1.0 through 2.14.2. The patch in version 2.14.3 blocks access to intranet IP addresses by default. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

CVAT is a Python-based application distributed via Docker images and source code. The vulnerability is not in a third-party package but in the application’s own logic for handling cloud storage endpoints. However, the SSRF vector could be used to interact with internal services that may themselves be vulnerable, potentially leading to supply chain impacts if those internal services are part of a CI/CD pipeline or artifact repository. Users should ensure that internal services are properly isolated and authenticated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a valid CVAT account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file listing/extraction
• Integrity Impact: Low (I:L) – limited file overwrite
• Availability Impact: High (A:H) – potential to disrupt internal services or CVAT itself

The threat level is High due to the potential for internal network reconnaissance and data manipulation, despite the requirement for authentication.

Deep Dive & Mechanics

The vulnerability is a classic SSRF (CWE-918) in the cloud storage integration feature. CVAT allows users to configure cloud storage backends by providing a custom endpoint URL. The application then makes HTTP requests to that URL to interact with the storage service (e.g., list buckets, upload/download files). The flaw is that the application does not properly validate the host part of the URL, allowing an attacker to specify internal IP addresses (e.g., http://192.168.1.1:9000) or internal domain names (e.g., http://internal-server.local).

Attack Flow:

1. An attacker with a CVAT account logs in and navigates to the cloud storage configuration.
2. The attacker creates a new cloud storage entry, specifying a custom endpoint URL pointing to an internal server (e.g., http://10.0.0.5:8080).
3. CVAT’s backend makes an HTTP request to that URL. If the server responds, the attacker can infer that the host is alive and running an HTTP server.
4. If the internal server is API-compatible with S3 or Azure Blob Storage (e.g., a MinIO instance or a misconfigured web server), the attacker may be able to:
   • List files (if anonymous access or known credentials are allowed).
   • Extract files (if they are of a type CVAT supports, such as images, videos, archives, annotations, or backups).
   • Overwrite files (by exporting annotations/datasets/backups to that endpoint).

Root Cause: Lack of validation on the host component of the user-supplied URL. The application should have used a blocklist or allowlist of IP ranges (e.g., RFC 1918 addresses) to prevent requests to private networks.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.14.3): The vulnerable code likely resides in the cloud storage handler, where the user-supplied endpoint URL is used directly in HTTP requests without host validation. For example:

# Vulnerable: No host validation
def create_cloud_storage(endpoint_url, credentials):
    # Directly uses endpoint_url to make requests
    response = requests.get(endpoint_url, auth=credentials)
    return response.json()

Patched Code (2.14.3): The patch applies existing SSRF mitigation measures to cloud provider requests. This likely involves checking the resolved IP address of the host against a blocklist of private IP ranges before making the request.

# Patched: Validate host IP
import ipaddress
from urllib.parse import urlparse

def is_private_ip(hostname):
    try:
        ip = ipaddress.ip_address(hostname)
        return ip.is_private
    except ValueError:
        # Resolve hostname to IP
        import socket
        ip = socket.gethostbyname(hostname)
        return ipaddress.ip_address(ip).is_private

def create_cloud_storage(endpoint_url, credentials):
    parsed = urlparse(endpoint_url)
    if is_private_ip(parsed.hostname):
        raise ValueError("Access to private IP addresses is prohibited")
    response = requests.get(endpoint_url, auth=credentials)
    return response.json()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable CVAT instance (version 2.1.0 to 2.14.2) using Docker:

   docker run -d -p 8080:8080 cvat/cvat:2.14.2
   

2. Set up an internal HTTP server (e.g., a simple Python HTTP server or a MinIO instance) on a private network (e.g., 172.17.0.2).
3. Create a CVAT account and log in.

Exploitation Steps:

1. Navigate to the cloud storage configuration page.
2. Create a new cloud storage with the following details:
   • Provider: Amazon S3
   • Endpoint URL: http://172.17.0.2:9000 (internal MinIO server)
   • Access Key ID: minioadmin
   • Secret Access Key: minioadmin
3. Save the configuration. CVAT will attempt to connect to the internal server.
4. If the internal server is API-compatible, the attacker can now list, extract, or overwrite files.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor CVAT logs for requests to private IP addresses (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x).
• Monitor network traffic from the CVAT backend for unexpected outbound connections to internal hosts.
• Use the detection rules provided below.

Hunting:

• Search for cloud storage configurations with endpoint URLs containing private IPs or internal domain names.
• Review CVAT access logs for unusual patterns of cloud storage creation or modification.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from CVAT backend to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to internal domain names (e.g., internal-server.local, corp-network).
• File IOCs:
  • Unexpected files appearing on internal servers that match CVAT export patterns (e.g., .zip, .xml, .json).
• Log IOCs:
  • CVAT application logs showing ERROR or WARNING for connections to private IPs.
  • CVAT audit logs showing creation of cloud storage with suspicious endpoint URLs.

Detection Engineering

YARA Rule

rule CVE_2024_37164_SSRF_CVAT {
    meta:
        description = "Detects CVAT cloud storage configuration with private IP endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37164"
    strings:
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $endpoint_key = "endpoint_url"
    condition:
        $endpoint_key and $private_ip
}

Sigma Rule

title: CVAT SSRF via Cloud Storage Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of CVAT cloud storage with private IP endpoint
author: Valters IT
date: 2024-10-27
logsource:
    product: cvat
    service: audit
detection:
    selection:
        event: "cloud_storage_created"
        endpoint_url|contains:
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate use of internal cloud storage (e.g., MinIO) if properly isolated
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37164 CVAT SSRF to Private IP"; flow:to_server; content:"GET"; http_method; content:"/api/cloudstorages"; http_uri; pcre:"/endpoint_url=(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to CVAT version 2.14.3 or later.
2. If upgrade is not possible, apply network security controls:
   • Use firewalls or virtual networks to block outbound traffic from CVAT backend to private IP ranges.
   • Require authentication for all internal HTTP servers.
   • Implement a web application firewall (WAF) to inspect and block requests to private IPs.

Long-term:

• Implement strict input validation for all user-supplied URLs, including hostname resolution and IP range checking.
• Use a blocklist of private and reserved IP ranges (RFC 1918, RFC 6598, etc.).
• Conduct regular security audits of cloud storage integration features.

Workarounds (per vendor):

• Use network security solutions such as virtual networks or firewalls to prohibit network access from the CVAT backend to unrelated servers on your internal network.
• Require authentication for access to internal servers.

Valters IT
Securing Digital Frontiers