CVE-2024-13029
📋 TL;DR
This vulnerability allows attackers to perform server-side request forgery (SSRF) attacks against Antabot White-Jotter systems. Attackers can manipulate the book cover URL functionality in the Edit Book Handler to make the server send unauthorized requests to internal or external systems. This affects all users running White-Jotter versions up to 0.2.2.
💻 Affected Systems
- Antabot White-Jotter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data from internal networks, or use the vulnerable server as a proxy for attacks against other systems.
Likely Case
Information disclosure from internal services, port scanning of internal networks, or limited data exfiltration from accessible internal endpoints.
If Mitigated
Limited impact with proper network segmentation, egress filtering, and input validation in place.
🎯 Exploit Status
Exploit requires admin authentication. Public proof-of-concept demonstrates SSRF via book cover URL manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
No official patch available. Upgrade to version above 0.2.2 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation for URLs
allImplement strict validation of book cover URLs to only allow HTTP/HTTPS URLs to trusted domains
Network Segmentation
allRestrict outbound network access from the White-Jotter server to only necessary services
🧯 If You Can't Patch
- Implement web application firewall rules to block SSRF patterns in book cover URL parameters
- Restrict admin access to trusted IP addresses only and implement strong authentication
🔍 How to Verify
Check if Vulnerable:
Check if White-Jotter version is 0.2.2 or earlier. Test if /admin/content/book endpoint accepts arbitrary URLs for book cover field.Check Version:
Check package.json or application configuration for version numberVerify Fix Applied:
Verify that book cover URL field only accepts validated URLs and cannot make requests to internal IPs or restricted domains.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from server
- Requests to internal IP addresses from application
- Multiple failed URL validation attempts
Network Indicators:
- Outbound requests to unusual ports from application server
- Requests to internal services from external-facing server
SIEM Query:
source_ip=application_server AND (dest_ip=internal_range OR dest_port!=80,443)