CVE-2024-0304 Overview
CVE-2024-0304 is a Server-Side Request Forgery (SSRF) vulnerability affecting Youke365 versions up to 1.5.3. The flaw resides in the /app/api/controller/collect.php file, where the url parameter is processed without sufficient validation. Attackers can manipulate this argument to coerce the application into issuing arbitrary outbound requests on their behalf. The issue is remotely exploitable, requires no authentication, and the exploit details have been publicly disclosed under VulDB identifier VDB-249871. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).
Critical Impact
Unauthenticated remote attackers can abuse the url parameter in collect.php to perform SSRF attacks, potentially reaching internal services, cloud metadata endpoints, or otherwise inaccessible network resources.
Affected Products
- Youke365 versions up to and including 1.5.3
- The /app/api/controller/collect.php endpoint
- Deployments exposing the Youke365 link directory application to untrusted networks
Discovery Timeline
- 2024-01-08 - CVE-2024-0304 published to the National Vulnerability Database (NVD)
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-0304
Vulnerability Analysis
The vulnerability exists in the collect.php controller within the Youke365 link directory application. This endpoint accepts a url parameter intended to fetch remote content for collection or aggregation purposes. The controller passes the user-supplied URL to a server-side HTTP request function without enforcing a domain allowlist, validating the destination IP, or restricting protocol schemes.
An attacker can supply arbitrary URLs targeting internal infrastructure. This includes 127.0.0.1, RFC1918 ranges, or cloud metadata services such as 169.254.169.254. The server then issues the request from its own network position, returning data the attacker would otherwise be unable to reach.
Root Cause
The root cause is missing input validation on the url parameter handled by the collect.php controller. The application trusts client-supplied destinations and does not enforce egress restrictions on outbound HTTP requests originating from the server.
Attack Vector
Exploitation requires only a single HTTP request to the vulnerable endpoint. No authentication, user interaction, or special privileges are needed. Attackers submit a crafted url value pointing at internal hosts or sensitive endpoints. The server-side fetch returns the response content, which can disclose internal service banners, cloud metadata credentials, or be used to pivot against unauthenticated internal APIs.
The vulnerability mechanism follows the standard SSRF pattern documented under CWE-918. Technical proof-of-concept details are available in the Zhao Jin Note Sharing writeup and the VulDB entry #249871.
Detection Methods for CVE-2024-0304
Indicators of Compromise
- Inbound HTTP requests to /app/api/controller/collect.php containing url= parameters referencing internal IP ranges, loopback addresses, or cloud metadata hosts such as 169.254.169.254
- Outbound HTTP requests originating from the Youke365 web server to non-public destinations not associated with normal collection activity
- Web server access logs showing unusual url parameter values referencing file://, gopher://, or dict:// schemes
Detection Strategies
- Inspect web server and application logs for query strings to collect.php containing private IP ranges, loopback addresses, or non-HTTP schemes
- Deploy web application firewall rules to flag SSRF-typical payloads targeting metadata endpoints and internal address spaces
- Correlate inbound requests to collect.php with subsequent outbound connections from the server to detect successful SSRF chains
Monitoring Recommendations
- Monitor egress traffic from Youke365 hosts and alert on connections to internal subnets or cloud metadata services
- Enable application-layer logging that captures the full url parameter value for every request to collect.php
- Track outbound DNS queries from the Youke365 server for anomalous lookups indicative of SSRF reconnaissance
How to Mitigate CVE-2024-0304
Immediate Actions Required
- Restrict public access to /app/api/controller/collect.php using web server access controls or upstream proxies
- Block outbound network access from the Youke365 server to internal subnets, loopback, and cloud metadata IPs at the firewall layer
- Audit historical access logs for prior exploitation attempts referencing the url parameter
Patch Information
No vendor patch has been documented in the available references for this issue. Operators should monitor the Youke365 project for an official fix and review the VulDB advisory for updates. Until a patch is available, apply the workarounds below.
Workarounds
- Implement an allowlist of permitted destination domains for any server-side fetch operations performed by collect.php
- Reject url parameter values that resolve to private, loopback, link-local, or reserved IP ranges before issuing any outbound request
- Restrict accepted URL schemes to http and https, blocking file://, gopher://, dict://, and similar protocol handlers
- Enforce network segmentation so the Youke365 application server cannot reach sensitive internal services or metadata endpoints
# Example iptables egress restriction blocking SSRF targets
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
