CVE-2024-48874
📋 TL;DR
This vulnerability allows attackers to force Ruijie Reyee OS proxy servers to make arbitrary requests, potentially accessing internal Ruijie services and AWS cloud metadata. It affects Ruijie Reyee OS versions 2.206.x through 2.319.x. Organizations using these vulnerable proxy servers are at risk.
💻 Affected Systems
- Ruijie Reyee OS
📦 What is this software?
Reyee Os by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Ruijie's internal cloud infrastructure, data exfiltration, lateral movement to other systems, and potential supply chain attacks.
Likely Case
Unauthorized access to internal services, metadata harvesting, and potential credential theft from cloud services.
If Mitigated
Limited impact with proper network segmentation and access controls preventing internal service access.
🎯 Exploit Status
CWE-918 (Server-Side Request Forgery) vulnerabilities typically have low exploitation complexity when unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.320.x or later
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
Restart Required: Yes
Instructions:
1. Check current Ruijie Reyee OS version. 2. Download and install version 2.320.x or later from Ruijie. 3. Restart affected proxy servers. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Ruijie proxy servers from internal networks and cloud metadata services
Access Control Lists
allImplement strict ACLs to limit which internal services proxy servers can access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Ruijie proxy servers from internal services
- Deploy web application firewalls with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check Ruijie Reyee OS version via admin interface or CLI. If version is between 2.206.x and 2.319.x, system is vulnerable.Check Version:
Check via Ruijie Reyee OS admin interface or consult Ruijie documentation for version check commands.Verify Fix Applied:
Confirm Ruijie Reyee OS version is 2.320.x or later and test proxy server functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from proxy servers
- Requests to internal services from proxy
- Access to cloud metadata endpoints
Network Indicators:
- Proxy servers making unexpected internal connections
- Traffic to AWS metadata services (169.254.169.254)
SIEM Query:
source="ruijie-proxy" AND (dest_ip IN internal_networks OR dest_ip="169.254.169.254")