CVE-2024-44677

Executive Summary

CVE-2024-44677 is a Server-Side Request Forgery (SSRF) vulnerability in eladmin v2.7 and earlier. The flaw resides in the DatabaseController.java component, allowing an unauthenticated attacker to craft requests that force the server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, and potentially remote code execution (RCE) if the attacker can chain the SSRF with other vulnerabilities (e.g., accessing internal management interfaces or cloud metadata endpoints). The vulnerability is publicly known, but no official patch has been released as of this report.

Supply Chain & Package Security

eladmin is a Java-based admin framework. The vulnerability is in the core application code, not in a third-party package. However, users should verify the integrity of their eladmin distribution and ensure no malicious modifications have been introduced.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of SSRF vulnerabilities, a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 8.6 (High)

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to significant internal network compromise.

Deep Dive & Mechanics

The vulnerability is in the DatabaseController.java component. This controller likely handles database connection testing or management. The SSRF occurs when the application takes user-supplied input (e.g., a URL or hostname) and uses it to make a server-side HTTP request without proper validation or sanitization.

Attack Flow:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /api/database/test).
2. The request includes a parameter that specifies a target URL (e.g., url=http://169.254.169.254/latest/meta-data/).
3. The server processes this request and makes an HTTP request to the attacker-specified URL.
4. The server returns the response to the attacker, potentially leaking sensitive information.

Potential Impact:

• Access to cloud metadata (e.g., AWS, GCP, Azure) leading to credential theft.
• Internal network scanning and service discovery.
• Exploitation of internal services (e.g., Redis, Memcached, internal APIs).
• Chaining with other vulnerabilities for RCE.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in DatabaseController.java. A typical vulnerable pattern might look like:

// Vulnerable code
@RequestMapping("/api/database/test")
public String testConnection(@RequestParam String url) {
    URL target = new URL(url);
    HttpURLConnection conn = (HttpURLConnection) target.openConnection();
    // ... process response
    return response;
}

A patched version would include input validation and allowlisting:

// Patched code
private static final Set<String> ALLOWED_HOSTS = Set.of("db.internal.example.com", "localhost");

@RequestMapping("/api/database/test")
public String testConnection(@RequestParam String url) {
    URL target = new URL(url);
    if (!ALLOWED_HOSTS.contains(target.getHost())) {
        throw new SecurityException("Host not allowed");
    }
    HttpURLConnection conn = (HttpURLConnection) target.openConnection();
    // ... process response
    return response;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of eladmin v2.7 or earlier.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/database/test).
2. Craft a request to probe internal services:

   curl -X POST "http://target.com/api/database/test" -d "url=http://127.0.0.1:8080/admin"
   

3. Attempt to access cloud metadata:

   curl -X POST "http://target.com/api/database/test" -d "url=http://169.254.169.254/latest/meta-data/"
   

4. Use the response to extract sensitive data or pivot to internal networks.

Advanced Exploitation:

• Use SSRF to attack internal Redis or Memcached servers.
• Chain with a file read vulnerability to achieve RCE.

Blue Team

Detection:

• Monitor for outbound HTTP requests from the application server to unexpected IPs (especially private IP ranges and cloud metadata IPs).
• Look for anomalous parameters in requests to /api/database/test or similar endpoints.

Hunting:

• Search logs for requests containing url= with internal IPs or cloud metadata URLs.
• Use network flow logs to identify connections from the application server to unusual destinations.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254, 127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x.
  • Requests to internal services like redis://, gopher://, file:// protocols.
• File IOCs:
  • Modified DatabaseController.java or related configuration files.
• Log IOCs:
  • Log entries showing url parameter with suspicious values.
  • Error logs indicating connection attempts to internal hosts.

Detection Engineering

YARA Rule

rule CVE_2024_44677_SSRF_eladmin {
    meta:
        description = "Detects SSRF exploitation attempts against eladmin v2.7"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-44677"
    strings:
        $s1 = "/api/database/test" ascii wide nocase
        $s2 = "url=" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "127.0.0.1" ascii wide nocase
        $s5 = "file://" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-44677 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against eladmin v2.7 via DatabaseController
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/database/test'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection and filter
falsepositives:
    - Legitimate database testing with internal hosts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44677 SSRF Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/database/test"; http_uri; content:"url="; http_client_body; pcre:"/url=(https?:\/\/)?(127\.0\.0\.1|169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet and internal networks if possible.
2. Implement a Web Application Firewall (WAF) rule to block requests containing internal IPs or cloud metadata URLs in the url parameter.
3. Restrict outbound network access from the application server using firewall rules.

Long-term Fix:

• Upgrade to a patched version of eladmin once available.
• Apply input validation and allowlisting for all user-supplied URLs.
• Disable the vulnerable endpoint if not required.

Workaround:

• Modify the DatabaseController.java source code to add URL validation (see patched code example above) and recompile the application.

Valters IT