CVE-2024-24113
📋 TL;DR
This SSRF vulnerability in xxl-job allows low-privileged users to make the server execute arbitrary requests to internal systems, potentially leading to remote code execution. It affects all deployments running xxl-job version 2.4.1 or earlier. Attackers can exploit this to compromise the executor component and gain control over affected systems.
💻 Affected Systems
- xxl-job
📦 What is this software?
Xxl Job by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the executor server, allowing lateral movement to internal networks and data exfiltration.
Likely Case
Unauthorized access to internal services, credential theft from metadata services, and potential RCE on vulnerable executor instances.
If Mitigated
Limited to information disclosure from internal endpoints if network segmentation and proper authentication are in place.
🎯 Exploit Status
Exploitation requires low-privileged user access. The GitHub issue contains technical details that could be weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.2
Vendor Advisory: https://github.com/xuxueli/xxl-job/issues/3375
Restart Required: Yes
Instructions:
1. Upgrade xxl-job to version 2.4.2 or later. 2. Update all executor and admin components. 3. Restart all xxl-job services. 4. Verify the fix by testing SSRF attempts.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from xxl-job executors to only necessary internal services
Access Control Enhancement
allImplement stricter authentication and authorization for low-privileged users
🧯 If You Can't Patch
- Implement strict network egress filtering to block executor access to sensitive internal endpoints
- Disable or restrict low-privileged user accounts and monitor for suspicious SSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check xxl-job version in admin interface or configuration files. If version <= 2.4.1, system is vulnerable.Check Version:
Check application.properties or xxl-job-admin logs for version informationVerify Fix Applied:
After upgrading to 2.4.2+, attempt SSRF payloads that previously worked should be blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from executor to internal services
- SSRF payload patterns in user input logs
- Failed authentication attempts followed by executor requests
Network Indicators:
- Executor making requests to internal metadata services (169.254.169.254)
- Unexpected outbound connections from xxl-job servers
SIEM Query:
source="xxl-job" AND (url="*169.254.169.254*" OR url="*localhost*" OR url="*127.0.0.1*")