CVE-2024-0308: Inis Project Inis SSRF Vulnerability

CVE-2024-0308 Overview

CVE-2024-0308 is a server-side request forgery (SSRF) vulnerability affecting Inis versions up to 2.0.1. The flaw resides in the app/api/controller/default/Proxy.php file, where the p_url argument is processed without proper validation. Attackers can manipulate this parameter to force the application to issue arbitrary outbound requests. The vulnerability is remotely exploitable and requires only low privileges. Public disclosure of the exploit has occurred, tracked as VDB-249875, increasing the risk of opportunistic attacks against unpatched deployments. The weakness is classified under CWE-918.

Critical Impact
Remote attackers with low privileges can abuse the p_url parameter in Proxy.php to send crafted requests from the server, potentially reaching internal services, cloud metadata endpoints, or exfiltrating data.

Affected Products

Inis versions up to and including 2.0.1
inis_project Inis application component Proxy.php
Deployments exposing the app/api/controller/default/Proxy.php endpoint

Discovery Timeline

2024-01-08 - CVE-2024-0308 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0308

Vulnerability Analysis

The vulnerability is a server-side request forgery (SSRF) issue in the Inis content management platform. The affected component is the proxy handler defined in app/api/controller/default/Proxy.php. This handler accepts a user-supplied URL through the p_url argument and forwards a request to the specified destination. Because the destination is not restricted to an allow-list or filtered against internal network ranges, an attacker controls where the server sends outbound requests. The impact extends to confidentiality, integrity, and availability, since the server can be coerced into interacting with internal services that may trust its origin.

Root Cause

The root cause is missing validation of the p_url parameter before it is used to construct a server-initiated HTTP request. The proxy function trusts the caller-provided value directly. There is no scheme allow-list, no host filtering against private or loopback ranges, and no rejection of cloud metadata IPs such as 169.254.169.254.

Attack Vector

An authenticated user with low privileges sends a crafted HTTP request to the proxy endpoint with a malicious value in p_url. The Inis backend then issues the request on the attacker's behalf. Attackers can target internal-only administrative interfaces, databases, cloud metadata services, or reachable third-party systems. Response content or timing differences can be used to fingerprint internal infrastructure.

No verified public exploit code is available. The technical write-up published at Zhaoj.in Share Overview and the entry at VulDB #249875 document the affected parameter and file path.

Detection Methods for CVE-2024-0308

Indicators of Compromise

Requests to app/api/controller/default/Proxy.php containing a p_url parameter pointing to internal, loopback, or link-local addresses.
Outbound connections from the Inis application host to 127.0.0.1, RFC1918 ranges, or 169.254.169.254.
Unusual HTTP response sizes or timing patterns on Proxy.php requests indicating internal probing.
Web server access logs showing repeated p_url values enumerating hosts or ports.

Detection Strategies

Inspect web application logs for Proxy.php requests and decode the p_url parameter to identify suspicious targets.
Correlate application-level requests with egress firewall or proxy logs to flag server-originated traffic to non-business destinations.
Alert on outbound requests from the Inis service account to cloud metadata endpoints or private IP ranges.

Monitoring Recommendations

Enable verbose access logging on the Inis web tier and forward logs to a centralized analytics platform for retrospective queries.
Baseline normal outbound destinations for the Inis host and alert on deviations.
Monitor authentication logs for low-privileged accounts issuing bursts of proxy requests.

How to Mitigate CVE-2024-0308

Immediate Actions Required

Restrict network access to the Proxy.php endpoint at the reverse proxy or web application firewall layer until an upgrade is applied.
Block outbound traffic from the Inis application host to internal ranges and cloud metadata IPs at the network layer.
Review recent access logs for exploitation attempts targeting the p_url parameter.
Rotate any credentials or tokens accessible from the Inis host if SSRF exploitation is suspected.

Patch Information

No vendor advisory URL is listed in the NVD record. Users of Inis 2.0.1 and earlier should consult the VulDB #249875 entry and the project's public repository for updated releases addressing SSRF in app/api/controller/default/Proxy.php.

Workarounds

Disable the Proxy.php endpoint if the proxy feature is not required in your deployment.
Implement a strict allow-list of destination hosts and schemes at a reverse proxy in front of Inis.
Configure egress filtering to prevent the application from reaching 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254.
Require additional authentication or CSRF tokens on the proxy route.

bash

# Example nginx block to restrict access to the vulnerable endpoint
location ~* /app/api/controller/default/Proxy\.php$ {
    allow 10.0.0.0/8;    # trusted internal management range
    deny all;
    return 403;
}

# Example egress restriction with iptables on the Inis host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT