CVE-2024-0945
📋 TL;DR
This critical vulnerability in 60IndexPage allows remote attackers to perform server-side request forgery (SSRF) by manipulating the 'url' parameter in /include/file.php. Attackers can exploit this to make the server send unauthorized requests to internal or external systems. All users of 60IndexPage versions up to 1.8.5 are affected.
💻 Affected Systems
- 60IndexPage
📦 What is this software?
60indexpage by 60indexpage Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration, or use as a pivot point for further attacks on internal systems.
Likely Case
Unauthorized access to internal services, information disclosure from internal endpoints, or abuse of server resources for scanning/attacks.
If Mitigated
Limited to accessing only allowed external resources or blocked by network segmentation.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading if newer versions become available or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Filtering
allImplement strict validation of the 'url' parameter to only allow expected domains and protocols
Modify /include/file.php to validate URL parameter against whitelist
Network Restriction
linuxConfigure server firewall to restrict outbound connections from web server
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Remove or disable 60IndexPage if not essential
- Implement web application firewall (WAF) rules to block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check if /include/file.php exists and contains parameter handling without proper URL validationCheck Version:
Check 60IndexPage version in configuration files or admin panelVerify Fix Applied:
Test if URL parameter manipulation no longer results in unauthorized external requests📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from web server
- Multiple failed connection attempts to internal IPs
- Requests to /include/file.php with URL parameter
Network Indicators:
- Web server making unexpected outbound connections
- Requests to internal services from web server IP
SIEM Query:
source="web_server" AND (url="*include/file.php*" OR dest_ip="10.*" OR dest_ip="192.168.*" OR dest_ip="172.16-31.*")