CVE-2024-0510
📋 TL;DR
This critical SSRF vulnerability in HaoKeKeJi YiQiNiu allows attackers to make unauthorized server-side HTTP requests to internal systems by manipulating the 'url' parameter in the http_post function. Attackers can potentially access internal services, exfiltrate data, or pivot to other systems. All users of YiQiNiu up to version 3.1 are affected.
💻 Affected Systems
- HaoKeKeJi YiQiNiu
📦 What is this software?
Yiqiniu by Haokekeji
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal infrastructure through SSRF chaining, data exfiltration from internal services, and potential lateral movement to critical systems.
Likely Case
Unauthorized access to internal APIs, metadata services, or cloud resources, potentially leading to data leakage or service disruption.
If Mitigated
Limited to port scanning internal networks or accessing non-sensitive services if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
Exploit code is publicly available on Packet Storm Security and other sources. Attack requires only HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Upgrade to version above 3.1 if available, or apply workarounds.
🔧 Temporary Workarounds
Input Validation and URL Whitelisting
allImplement strict input validation on the 'url' parameter to only allow expected domains and protocols.
Modify /application/pay/controller/Api.php to validate URL parameter against whitelist
Network Egress Filtering
linuxRestrict outbound HTTP/HTTPS connections from the server to only necessary external services.
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement WAF rules to block requests containing internal IP addresses or unusual URL patterns in the 'url' parameter.
- Isolate the vulnerable system in a restricted network segment with no access to internal services.
🔍 How to Verify
Check if Vulnerable:
Test by sending a POST request to the vulnerable endpoint with a controlled URL parameter pointing to a monitoring service (like Burp Collaborator or similar).Check Version:
Check application version in configuration files or admin interface; look for version 3.1 or lower.Verify Fix Applied:
Attempt the same SSRF test after applying fixes; successful fix should block or sanitize malicious URL parameters.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the server to internal IPs
- Requests to metadata services (169.254.169.254)
- Multiple failed connection attempts to various ports
Network Indicators:
- HTTP traffic from server to unexpected internal destinations
- Port scanning patterns originating from the server
SIEM Query:
source_ip=server_ip AND (dest_ip=internal_range OR dest_ip=169.254.169.254) AND protocol=HTTP