CVE-2024-55086

Executive Summary

CVE-2024-55086 is a Server-Side Request Forgery (SSRF) vulnerability identified in the GetSimple CMS CE 3.3.19 management page. The flaw resides in the plug-in download address functionality within the backend management system, allowing an authenticated administrator to force the server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, or further exploitation of internal services. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone CMS application written in PHP.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD; calculated as 4.9 Medium based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin access required)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin credentials, but can lead to significant internal network reconnaissance.

Deep Dive & Mechanics

The vulnerability exists in the backend plug-in download functionality. When an administrator attempts to download a plug-in from a remote URL, the application does not properly validate or sanitize the provided URL. An attacker with admin privileges can supply a malicious URL pointing to internal resources (e.g., http://127.0.0.1:8080/admin or http://192.168.1.1/config) instead of a legitimate plug-in source. The server then makes an HTTP request to that URL, potentially exposing sensitive data or allowing interaction with internal services.

The core issue is the lack of URL validation and restriction on the destination host/port. The application likely uses PHP functions like file_get_contents() or curl_exec() without proper allowlisting or blocklisting of IP ranges.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plug-in download handler. A typical vulnerable PHP snippet might look like:

// Vulnerable code
$url = $_POST['plugin_url'];
$content = file_get_contents($url);
// Process $content...

A patched version would include validation:

// Patched code
$url = $_POST['plugin_url'];
$parsed_url = parse_url($url);
$host = $parsed_url['host'];
$ip = gethostbyname($host);
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $content = file_get_contents($url);
    // Process $content...
} else {
    die("Invalid URL: internal IPs not allowed.");
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Admin credentials for GetSimple CMS CE 3.3.19.
2. Steps:
   • Log in to the admin panel.
   • Navigate to the plug-in management section.
   • In the "Download plug-in from URL" field, enter a malicious URL such as http://127.0.0.1:80/ or http://192.168.1.100:8080/.
   • Submit the request.
   • Observe the server response, which may include the contents of the internal resource.
3. Advanced: Use SSRF to access cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/ on AWS) or internal services like Redis or databases.

Blue Team

1. Detection: Monitor outbound HTTP requests from the web server to unexpected internal IPs or ports.
2. Prevention: Implement network segmentation to restrict the web server's outbound access. Use a web application firewall (WAF) to block requests to private IP ranges.
3. Hunting: Review server logs for requests to 127.0.0.1, 10.*, 172.16-31.*, 192.168.*, or 169.254.* originating from the admin panel.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the server to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Logs: Admin panel access logs showing unusual URLs in the plug-in download field.
• File: Unexpected files downloaded to the server's plug-in directory (e.g., /plugins/).

Detection Engineering

YARA Rule

rule CVE_2024_55086_SSRF_GetSimple {
    meta:
        description = "Detects SSRF attempts in GetSimple CMS CE 3.3.19"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55086"
    strings:
        $url_param = "plugin_url" nocase
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $url_param and $internal_ip
}

Sigma Rule

title: SSRF Attempt in GetSimple CMS Admin Panel
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SSRF attempts via plugin download URL in GetSimple CMS CE 3.3.19
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'plugin_url'
        cs-uri-query|contains:
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate plugin downloads from internal repositories (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55086 SSRF Attempt in GetSimple CMS"; flow:to_server,established; content:"POST"; http_method; content:"plugin_url"; http_client_body; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict outbound HTTP access from the web server to only trusted external hosts using firewall rules.
• Short-term: Manually patch the vulnerable code by adding URL validation (see patched code example above).
• Long-term: Upgrade to a patched version of GetSimple CMS if/when released. Consider migrating to a more actively maintained CMS.
• Compensating Controls: Implement a WAF rule to block requests containing private IP addresses in the plugin_url parameter. Enforce strict admin access controls and monitor admin activity.

Valters IT
Securing Digital Frontiers