CVE-2024-13029: Antabot White-jotter SSRF Vulnerability

CVE-2024-13029 Overview

CVE-2024-13029 is a server-side request forgery (SSRF) vulnerability in Antabot White-Jotter versions up to 0.2.2. The flaw resides in the Edit Book Handler component, specifically an unknown function reachable through the /admin/content/book endpoint. An authenticated attacker with low privileges can manipulate the book cover URL parameter to coerce the application into issuing arbitrary HTTP requests. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Attackers can abuse the vulnerable server to send crafted requests to internal network resources, potentially reaching internal services, metadata endpoints, or restricted APIs that are not directly exposed to the internet.

Affected Products

Antabot White-Jotter versions up to and including 0.2.2
Component: Edit Book Handler at /admin/content/book
Deployments exposing the administrative interface to untrusted networks

Discovery Timeline

2024-12-30 - CVE-2024-13029 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13029

Vulnerability Analysis

The vulnerability affects the book editing workflow in White-Jotter, an open-source book management application. The Edit Book Handler accepts a URL value used to retrieve a book cover image. The server fetches the supplied URL without validating the target host, scheme, or address family. This allows an authenticated user to redirect the server-side HTTP client toward arbitrary destinations, including internal-only endpoints. Because White-Jotter is deployed as an administrative content platform, the SSRF primitive can be used to probe backend infrastructure, enumerate internal services, and interact with metadata services in cloud deployments.

Root Cause

The root cause is missing validation and allow-listing of user-controlled URL input in the book cover retrieval flow. The application trusts the URL parameter passed to /admin/content/book and performs an outbound request from the server context. There is no restriction on the destination hostname, no denial of private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8), and no scheme filtering.

Attack Vector

Exploitation requires network access to the administrative interface and low-privilege authentication. An attacker submits an edited book record with the cover URL pointing to an internal address such as http://127.0.0.1:8080/ or a cloud metadata endpoint. The server issues the request and, depending on the response handling, may return content, timing signals, or status codes usable to enumerate internal assets. See the disclosed technical write-up at Vulnerability-Research: ServerSideRequestForgery-BookCoverURL for the parameter details and reproduction steps.

Detection Methods for CVE-2024-13029

Indicators of Compromise

Outbound HTTP requests originating from the White-Jotter application server to internal IP ranges or loopback addresses.
Unexpected access log entries at /admin/content/book containing cover URL parameters referencing non-image endpoints.
Application logs showing image-fetch operations that resolve to private, link-local, or cloud metadata addresses such as 169.254.169.254.

Detection Strategies

Inspect web server access logs for POST or PUT requests to /admin/content/book and correlate them with subsequent outbound connections from the application host.
Deploy egress network monitoring to alert on connections from the White-Jotter server to internal RFC1918 ranges or cloud metadata services.
Review authentication logs for administrative sessions that modify book records at unusual times or from unexpected source addresses.

Monitoring Recommendations

Instrument the application host with process and network telemetry to capture outbound requests initiated by the Java or web runtime.
Alert on any HTTP client requests from the application to destinations outside an approved allow-list of external image hosts.
Retain administrative interface access logs and correlate them against network flow data for post-incident review.

How to Mitigate CVE-2024-13029

Immediate Actions Required

Restrict access to /admin/content/book and the entire /admin/ path to trusted management networks using firewall or reverse proxy rules.
Audit existing administrative accounts and enforce strong authentication to reduce the pool of users able to trigger the vulnerable code path.
Block outbound traffic from the White-Jotter server to internal networks and cloud metadata endpoints where not required for operation.

Patch Information

At the time of publication, no vendor-supplied patch has been referenced in the NVD entry for versions above 0.2.2. Operators should track the upstream project repository for fixes and apply updates once released. Consult the disclosure document at cydtseng Vulnerability-Research and the VulDB entry #289722 for the latest status.

Workarounds

Place the application behind a forward proxy that enforces an allow-list of permitted image-hosting domains for outbound fetches.
Configure host-based firewall rules to deny the White-Jotter process from connecting to private IP ranges and 169.254.169.254.
Disable the book cover URL feature or replace remote fetching with local file uploads if the codebase permits customization.

bash

# Example iptables rules restricting egress from the application host
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner whitejotter -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner whitejotter -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner whitejotter -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner whitejotter -j REJECT
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner whitejotter -j REJECT