CVE-2024-0649: Zhiyun-tech Zhihuiyun SSRF Vulnerability

CVE-2024-0649 Overview

A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in ZhiHuiYun versions up to 4.4.13. This vulnerability affects the download_network_image function within the /app/Http/Controllers/ImageController.php file of the Search component. Through manipulation of the url argument, attackers can initiate unauthorized server-side requests to arbitrary destinations, potentially compromising internal network resources and sensitive data.

Critical Impact

This SSRF vulnerability allows unauthenticated remote attackers to force the vulnerable server to make requests to internal or external systems, potentially exposing sensitive internal services, bypassing network access controls, and enabling further attacks on backend infrastructure.

Affected Products

• ZhiHuiYun versions up to and including 4.4.13
• Zhiyun-tech ZhiHuiYun web application

Discovery Timeline

• 2024-01-17 - CVE-2024-0649 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0649

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The SSRF flaw exists in the image downloading functionality of ZhiHuiYun, where the application fails to properly validate and sanitize user-supplied URLs before making server-side HTTP requests.

The download_network_image function in ImageController.php accepts a url parameter from user input and uses it to fetch remote images. Without proper validation, an attacker can manipulate this parameter to make the server send requests to arbitrary destinations, including internal network resources that would otherwise be inaccessible from external networks.

The exploit has been publicly disclosed, increasing the risk of widespread exploitation. Technical details have been documented in external references including the VulDB vulnerability database.

Root Cause

The root cause of this vulnerability is insufficient input validation in the download_network_image function. The application does not implement adequate URL validation, scheme restrictions, or allowlisting mechanisms before processing the user-supplied url parameter. This allows attackers to specify arbitrary URLs, including those pointing to internal network resources, cloud metadata endpoints, or other sensitive services.

The lack of URL scheme validation means attackers may be able to use various protocols beyond HTTP/HTTPS, potentially including file://, dict://, gopher://, or other schemes depending on the underlying HTTP library configuration.

Attack Vector

The attack can be initiated remotely without authentication. An attacker sends a crafted request to the vulnerable endpoint with a malicious url parameter. The server then makes a request to the attacker-specified destination on behalf of the application.

Common SSRF attack scenarios for this vulnerability include:

• Accessing internal services on localhost or private IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x)
• Retrieving cloud instance metadata from services like AWS (169.254.169.254), GCP, or Azure
• Port scanning internal network infrastructure
• Bypassing firewall restrictions to access protected resources
• Potential for chained attacks leading to remote code execution if internal services have additional vulnerabilities

The vulnerability is exploitable via the Search component's image functionality, where the attacker manipulates the URL parameter to point to internal resources or sensitive endpoints. For detailed technical information, refer to the Zhaoj blog post documenting the vulnerability.

Detection Methods for CVE-2024-0649

Indicators of Compromise

• Unusual outbound requests from the ZhiHuiYun server to internal IP ranges or localhost
• HTTP requests to cloud metadata endpoints (e.g., 169.254.169.254)
• Requests to the ImageController.php endpoint with suspicious URL parameters containing internal addresses
• Failed or unusual DNS resolutions originating from the web server
• Access logs showing requests with encoded or obfuscated internal URLs in the url parameter

Detection Strategies

• Monitor web application logs for requests to /app/Http/Controllers/ImageController.php with suspicious url parameters
• Implement network-level monitoring for outbound connections from web servers to internal IP ranges or metadata endpoints
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in URL parameters
• Configure intrusion detection systems (IDS) to alert on requests containing internal IP addresses or cloud metadata URLs

Monitoring Recommendations

• Enable detailed logging for the ZhiHuiYun application, particularly for image download operations
• Set up alerts for any outbound connections from the application server to RFC 1918 private address ranges
• Monitor for DNS queries from the web server for internal hostnames or suspicious domains
• Review access logs periodically for patterns indicative of SSRF exploitation attempts

How to Mitigate CVE-2024-0649

Immediate Actions Required

• Upgrade ZhiHuiYun to the latest available version if a patched release is available
• Implement URL validation and allowlisting for the image download functionality
• Restrict outbound network connections from the web server to only necessary external resources
• Deploy a Web Application Firewall (WAF) with SSRF protection rules
• Consider disabling the download_network_image functionality if not critical to operations

Patch Information

No official vendor patch information is currently available in the CVE data. Organizations using ZhiHuiYun should contact Zhiyun-tech directly for security updates and monitor the VulDB entry for additional mitigation guidance. The vulnerability affects all versions up to and including 4.4.13.

Workarounds

• Implement server-side URL validation to restrict requests to approved external domains only
• Block requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata IPs
• Use network segmentation to limit the web server's access to internal resources
• Deploy egress filtering at the network level to prevent unauthorized outbound connections
• Consider placing the application behind a reverse proxy with request filtering capabilities

# Example network-level mitigation using iptables
# Block outbound connections to internal networks from web server
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j DROP