CVE-2024-37818

Executive Summary

CVE-2024-37818 is a disputed Server-Side Request Forgery (SSRF) vulnerability reported in Strapi v4.24.4. The claim states that a crafted GET request to the /strapi.io/_next/image component can allow an attacker to scan for open ports or access sensitive information. However, the Strapi Development Community strongly disputes this, arguing that the flaw is specific to the strapi.io website and does not pose a real SSRF risk to applications using the Strapi library. The EPSS score is 0.0%, indicating very low exploitation probability. No official patch has been released, and the vulnerability is considered invalid by the vendor.

Supply Chain & Package Security

Strapi is an open-source headless CMS distributed via npm. The disputed nature of this CVE means no supply chain advisory has been issued. Users should monitor official Strapi channels for any future clarifications or patches.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Disputed)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (if valid)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Low (Disputed)

Deep Dive & Mechanics

The alleged vulnerability involves the /strapi.io/_next/image endpoint, which is part of the Next.js image optimization feature used on the strapi.io website. The claim is that an attacker can craft a GET request to this endpoint with a manipulated URL parameter, causing the server to make an outbound request to an attacker-controlled destination. This could be used to scan internal networks or access metadata endpoints (e.g., cloud provider metadata).

Dispute: The Strapi community argues that this endpoint is not part of the Strapi library itself but rather a component of the strapi.io marketing website. Therefore, it does not affect self-hosted Strapi instances. The vulnerability, if real, would only impact the strapi.io website, not the Strapi CMS software.

Vulnerable vs. Patched Code

Since the vulnerability is disputed and no official patch exists, there is no patched code to compare. The alleged vulnerable code is in the Next.js image optimization handler on strapi.io, which is not part of the Strapi npm package.

Exploitation & Lab Setup

Red Team

Note: This exploit is disputed and may not work against self-hosted Strapi instances. It targets the strapi.io website only.

1. Reconnaissance: Identify if the target is running strapi.io or a custom Strapi instance. The endpoint /strapi.io/_next/image is specific to the official website.
2. Crafting the Request: Send a GET request to https://target.com/strapi.io/_next/image?url=http://attacker-controlled-server.com/test.png&w=32&q=75.
3. Observation: Monitor your attacker-controlled server for incoming connections. If the target makes a request to your server, the SSRF is confirmed.
4. Port Scanning: Use the SSRF to scan internal ports by changing the URL to internal IPs (e.g., http://127.0.0.1:8080).

Example curl command:

curl -v "https://target.com/strapi.io/_next/image?url=http://attacker-controlled-server.com/test.png&w=32&q=75"

Blue Team

1. Monitor Outbound Requests: Log all outbound requests from your Strapi server, especially to unexpected destinations.
2. Web Application Firewall (WAF): Block requests to /strapi.io/_next/image if you are not using the official Strapi website.
3. Network Segmentation: Ensure your Strapi server cannot access internal metadata endpoints (e.g., 169.254.169.254).
4. Input Validation: Validate and sanitize all URL parameters in image optimization endpoints.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled servers from the Strapi server.
• Logs: GET requests to /strapi.io/_next/image with suspicious url parameters pointing to internal IPs or external servers.
• File System: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_37818_SSRF_Strapi {
    meta:
        description = "Detects SSRF attempts targeting Strapi /strapi.io/_next/image endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37818"
    strings:
        $endpoint = "/strapi.io/_next/image"
        $url_param = "url="
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $endpoint and $url_param and $internal_ip
}

Sigma Rule

title: CVE-2024-37818 SSRF Attempt on Strapi
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts targeting the /strapi.io/_next/image endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/strapi.io/_next/image?url="
    condition: selection
falsepositives:
    - Legitimate use of the strapi.io website
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37818 SSRF Attempt on Strapi"; flow:to_server; content:"/strapi.io/_next/image"; http_uri; content:"url="; http_uri; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Official Patch: No official patch exists as the vulnerability is disputed. Monitor Strapi's GitHub and security advisories for updates.
• Mitigation: If you are running a self-hosted Strapi instance, this vulnerability does not apply. If you are hosting the strapi.io website, restrict access to the /strapi.io/_next/image endpoint or implement strict URL validation.
• Workaround: Block requests to /strapi.io/_next/image at the reverse proxy or WAF level.
• Monitoring: Enable logging for all outbound requests and review for suspicious patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence