CVE-2024-6524
📋 TL;DR
This is a Server-Side Request Forgery (SSRF) vulnerability in ShopXO's Uploader.php component. Attackers can manipulate the 'source' parameter to make the server send unauthorized requests to internal or external systems. All ShopXO installations up to version 6.1.0 are affected.
💻 Affected Systems
- ShopXO
📦 What is this software?
Shopxo by Shopxo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, perform port scanning of internal networks, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Information disclosure from internal services, potential data exfiltration, and abuse of the vulnerable server as a proxy for attacks against other systems.
If Mitigated
Limited impact with proper network segmentation and egress filtering, though some information disclosure may still occur.
🎯 Exploit Status
Public exploit available on GitHub. Attack can be launched remotely without authentication. Original disclosure confused CSRF with SSRF.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor ShopXO vendor for official patch. 2. Check if version 6.1.1 or later addresses this vulnerability. 3. Apply patch when available.
🔧 Temporary Workarounds
Input Validation and Filtering
allAdd validation to restrict the 'source' parameter to allowed URLs only
Modify extend/base/Uploader.php to validate source parameter against whitelist
Network Egress Filtering
linuxRestrict outbound connections from web server to only necessary services
Configure firewall to block outbound HTTP/HTTPS from web server except to trusted destinations
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block SSRF patterns
- Disable or restrict access to the vulnerable Uploader.php component
🔍 How to Verify
Check if Vulnerable:
Check if ShopXO version is ≤6.1.0 and if extend/base/Uploader.php exists with vulnerable source parameter handlingCheck Version:
Check ShopXO configuration files or admin panel for version informationVerify Fix Applied:
Test if source parameter can no longer make requests to arbitrary URLs📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server
- Requests to internal IP addresses or unusual domains from Uploader.php
Network Indicators:
- Web server making unexpected outbound HTTP/HTTPS connections
- Requests to internal network segments from external-facing server
SIEM Query:
source="web_server" AND (dest_ip IN private_ranges OR dest_domain NOT IN allowed_domains) AND uri_path="/extend/base/Uploader.php"🔗 References
- https://github.com/J1rrY-learn/learn/blob/main/shopxo_ssrf.md
- https://vuldb.com/?ctiid.270367
- https://vuldb.com/?id.270367
- https://vuldb.com/?submit.365173
- https://github.com/J1rrY-learn/learn/blob/main/shopxo_ssrf.md
- https://vuldb.com/?ctiid.270367
- https://vuldb.com/?id.270367
- https://vuldb.com/?submit.365173
