CVE-2024-52588

Executive Summary

CVE-2024-52588 is a Server-Side Request Forgery (SSRF) vulnerability in Strapi, an open-source headless CMS. The flaw resides in the Webhooks URL field, where an authenticated attacker with administrative privileges can input a local domain (e.g., localhost, 127.0.0.1, or internal IP addresses). When the webhook is triggered, the Strapi server makes an HTTP request to that local domain, effectively fetching itself or internal services. This can lead to information disclosure, internal network scanning, or exploitation of other internal services. The vulnerability is patched in Strapi version 4.25.2.

Supply Chain & Package Security

Strapi is distributed via npm as the @strapi/strapi package. Organizations using Strapi should verify their installed version and update to the patched release. The vulnerability does not affect the npm package itself but the application logic within the Strapi admin panel.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires admin access to the Strapi admin panel
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited to internal network information
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The medium severity is due to the requirement of administrative privileges, but the potential for internal network reconnaissance and exploitation of other services makes it a significant risk.

Deep Dive & Mechanics

The vulnerability exists in the webhook configuration feature of Strapi. When an admin user creates or edits a webhook, they can specify a URL. The application does not properly validate whether the URL points to a local or internal address. When the webhook is triggered (e.g., on content creation or update), Strapi makes an HTTP request to the specified URL. If the URL is http://localhost:1337/admin/init, the server will make a request to itself, potentially exposing sensitive data or allowing the attacker to interact with internal services.

The root cause is insufficient input validation on the webhook URL field. The application should reject URLs that resolve to loopback addresses, private IP ranges, or the server's own hostname.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.25.2):

// In webhook creation/update logic
const url = req.body.url;
// No validation of URL target
await strapi.webhookStore.create({ url });

Patched Code (4.25.2):

// In webhook creation/update logic
const url = req.body.url;
if (isInternalUrl(url)) {
  throw new Error('Webhook URL cannot point to internal resources');
}
await strapi.webhookStore.create({ url });

The isInternalUrl function checks if the URL resolves to a loopback address, private IP, or the server's own hostname.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Strapi admin panel with admin privileges
• Strapi version < 4.25.2

Exploitation Steps:

1. Log in to the Strapi admin panel.
2. Navigate to Settings > Webhooks.
3. Create a new webhook with the URL http://127.0.0.1:1337/admin/init (or any internal service).
4. Trigger the webhook by creating/updating content.
5. The server will make a request to itself, potentially leaking sensitive data in the response.

Example Payload:

{
  "url": "http://localhost:1337/admin/init",
  "events": ["entry.create"]
}

Blue Team

Detection:

• Monitor for webhook creation/modification events in Strapi logs.
• Look for webhook URLs containing localhost, 127.0.0.1, 0.0.0.0, or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Alert on outbound HTTP requests from the Strapi server to itself or internal IPs.

Prevention:

• Upgrade to Strapi 4.25.2 or later.
• Implement network segmentation to limit the impact of SSRF.
• Use a web application firewall (WAF) to block requests to internal IPs.

Indicators of Compromise (IOCs)

• Webhook URLs containing localhost, 127.0.0.1, 0.0.0.0, or private IP ranges.
• Unusual outbound HTTP requests from the Strapi server to itself or internal services.
• Strapi logs showing webhook triggers with suspicious URLs.

Detection Engineering

YARA Rule

rule CVE_2024_52588_Strapi_SSRF {
  meta:
    description = "Detects Strapi webhook URLs pointing to internal resources"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-52588"
  strings:
    $url1 = "localhost" nocase
    $url2 = "127.0.0.1"
    $url3 = "0.0.0.0"
    $url4 = /10\.\d{1,3}\.\d{1,3}\.\d{1,3}/
    $url5 = /172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}/
    $url6 = /192\.168\.\d{1,3}\.\d{1,3}/
  condition:
    any of ($url*) and #url* > 0
}

Sigma Rule

title: Strapi Webhook SSRF Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of Strapi webhooks with internal URLs
author: Valters IT
date: 2024/01/01
logsource:
  product: strapi
  service: webhook
detection:
  selection:
    url|contains:
      - 'localhost'
      - '127.0.0.1'
      - '0.0.0.0'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  condition: selection
falsepositives:
  - Legitimate use of internal services (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52588 Strapi SSRF Webhook"; flow:to_server,established; content:"POST"; http_method; content:"/admin/webhooks"; http_uri; content:"url"; nocase; pcre:"/localhost|127\.0\.0\.1|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Strapi to version 4.25.2 or later.
• Review and remove any suspicious webhooks.

Long-term:

• Implement strict input validation for all URL fields.
• Use a deny list for internal IP ranges and loopback addresses.
• Monitor webhook activity and alert on anomalies.
• Conduct regular security audits of Strapi configurations.

Workaround:

• If immediate upgrade is not possible, restrict admin panel access to trusted IPs only.
• Disable webhook functionality if not needed.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.