CVE-2024-5885

Executive Summary

CVE-2024-5885 is a critical Server-Side Request Forgery (SSRF) vulnerability in stangirard/quivr version 0.0.236. The application fails to implement sufficient controls when crawling a website, allowing an attacker to make arbitrary requests from the server. This can be exploited to access internal services, the AWS EC2 metadata endpoint, and capture Supabase data. The vulnerability has a CVSS score of 8.6 (High) and is currently unpatched. No public exploit code or Nuclei template is available, but the attack vector is well-understood.

Supply Chain & Package Security

This vulnerability affects the Quivr application, which is a Python-based open-source project. The application is distributed via GitHub and can be deployed using Docker. The SSRF flaw exists in the web crawling functionality, which is a core feature of the application. Since no patch is available, users must implement their own mitigations or restrict network access to the application.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the potential for complete compromise of the server and internal network.

Deep Dive & Mechanics

The vulnerability resides in the web crawling functionality of Quivr. When a user provides a URL for the application to crawl, the application does not validate or restrict the target. An attacker can supply a URL pointing to internal resources, such as:

• http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint)
• http://localhost:5432/ (local PostgreSQL/Supabase)
• http://internal-service.local/

The server will then make a request to that URL and return the response to the attacker. This allows the attacker to bypass network segmentation and access sensitive data.

The lack of a blocklist or allowlist for private IP ranges (RFC 1918) and loopback addresses is the root cause.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code. The vulnerable function likely looks like this:

# Vulnerable code (conceptual)
def crawl_url(url):
    response = requests.get(url)
    return response.text

A patched version would include validation:

# Patched code (conceptual)
import ipaddress
from urllib.parse import urlparse

def is_private_ip(ip):
    try:
        ip_obj = ipaddress.ip_address(ip)
        return ip_obj.is_private or ip_obj.is_loopback
    except ValueError:
        return False

def crawl_url(url):
    parsed = urlparse(url)
    hostname = parsed.hostname
    if is_private_ip(hostname):
        raise ValueError("Access to private IPs is not allowed")
    response = requests.get(url)
    return response.text

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would:

1. Identify a Quivr instance (e.g., http://target.com/).
2. Use the crawl functionality to request internal resources.

Example exploitation using curl:

# Exploit to access AWS metadata
curl -X POST http://target.com/crawl \
  -H "Content-Type: application/json" \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

# Exploit to access local Supabase
curl -X POST http://target.com/crawl \
  -H "Content-Type: application/json" \
  -d '{"url": "http://localhost:5432/"}'

The response will contain the data from the internal service.

Blue Team

To detect exploitation attempts, monitor for:

• Outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Requests to the AWS metadata endpoint (169.254.169.254).
• Unusual URLs in crawl requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to 169.254.169.254 from the Quivr server.
  • Outbound connections to 127.0.0.1 or localhost from the Quivr server.
  • Outbound connections to private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x).
• Log IOCs:
  • Log entries showing crawl requests to internal IP addresses.
  • Log entries with URLs containing 169.254.169.254 or localhost.
• File IOCs:
  • No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_5885_SSRF_Quivr {
    meta:
        description = "Detects SSRF exploitation attempts against Quivr"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-5885"
    strings:
        $ssrf1 = "169.254.169.254" ascii wide nocase
        $ssrf2 = "localhost" ascii wide nocase
        $ssrf3 = "127.0.0.1" ascii wide nocase
        $ssrf4 = "10." ascii wide nocase
        $ssrf5 = "192.168." ascii wide nocase
        $ssrf6 = "172.16." ascii wide nocase
        $ssrf7 = "172.17." ascii wide nocase
        $ssrf8 = "172.18." ascii wide nocase
        $ssrf9 = "172.19." ascii wide nocase
        $ssrf10 = "172.20." ascii wide nocase
        $ssrf11 = "172.21." ascii wide nocase
        $ssrf12 = "172.22." ascii wide nocase
        $ssrf13 = "172.23." ascii wide nocase
        $ssrf14 = "172.24." ascii wide nocase
        $ssrf15 = "172.25." ascii wide nocase
        $ssrf16 = "172.26." ascii wide nocase
        $ssrf17 = "172.27." ascii wide nocase
        $ssrf18 = "172.28." ascii wide nocase
        $ssrf19 = "172.29." ascii wide nocase
        $ssrf20 = "172.30." ascii wide nocase
        $ssrf21 = "172.31." ascii wide nocase
    condition:
        any of ($ssrf*)
}

Sigma Rule

title: CVE-2024-5885 Quivr SSRF Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF exploitation attempts against Quivr
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5885
logsource:
    category: webserver
    product: quivr
detection:
    selection:
        cs-uri-query|contains:
            - '169.254.169.254'
            - 'localhost'
            - '127.0.0.1'
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
    condition: selection
falsepositives:
    - Legitimate internal crawling (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5885 Quivr SSRF Exploitation"; flow:to_server,established; content:"GET"; http_method; content:"/crawl"; http_uri; pcre:"/(169\.254\.169\.254|localhost|127\.0\.0\.1|10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Network Segmentation: Place the Quivr server in a network segment that cannot access internal resources or the AWS metadata endpoint.
2. Web Application Firewall (WAF): Deploy a WAF to block requests containing private IP addresses or the AWS metadata endpoint.
3. Input Validation: Implement server-side validation to block URLs pointing to private IP ranges and loopback addresses.
4. Disable Crawling: If the crawling feature is not essential, disable it.
5. Monitor Logs: Actively monitor logs for SSRF attempts.
6. Update: Watch for an official patch and apply it as soon as it becomes available.

Valters IT