CVE-2024-24113: Xuxueli Xxl-job SSRF Vulnerability

CVE-2024-24113 Overview

CVE-2024-24113 is a Server-Side Request Forgery (SSRF) vulnerability affecting xxl-job versions 2.4.1 and earlier. This vulnerability enables low-privileged users to manipulate the executor component, ultimately leading to Remote Code Execution (RCE). The xxl-job distributed task scheduling platform is widely used in enterprise environments for job orchestration, making this vulnerability particularly concerning for organizations relying on this software for critical task automation.

Critical Impact

Low-privileged authenticated users can exploit the SSRF vulnerability to control the executor component and achieve Remote Code Execution, potentially compromising the entire task scheduling infrastructure and connected systems.

Affected Products

• xuxueli xxl-job versions 2.4.1 and earlier
• All deployments of xxl-job utilizing the vulnerable executor communication mechanism

Discovery Timeline

• 2024-02-08 - CVE-2024-24113 published to NVD
• 2025-05-15 - Last updated in NVD database

Technical Details for CVE-2024-24113

Vulnerability Analysis

The vulnerability exists in the xxl-job distributed task scheduling platform, specifically in how the admin console communicates with executor instances. The SSRF flaw allows authenticated users with low privileges to craft malicious requests that the server will process and forward to arbitrary destinations, including internal network resources.

The core issue stems from insufficient validation of user-supplied input when the xxl-job admin console processes requests destined for executor endpoints. By manipulating these requests, an attacker can redirect the server to make connections to attacker-controlled or internal endpoints, bypassing network segmentation and security controls.

What makes this vulnerability particularly severe is the escalation path to Remote Code Execution. Once an attacker successfully exploits the SSRF to gain control over executor communication, they can leverage this access to execute arbitrary commands on the executor nodes, which are typically deployed across multiple servers in a distributed environment.

Root Cause

The root cause of CVE-2024-24113 is classified as CWE-918 (Server-Side Request Forgery). The xxl-job application fails to properly validate and sanitize URLs or endpoint addresses provided by users before making server-side HTTP requests. This lack of input validation allows attackers to specify arbitrary destinations for the server's outbound requests, effectively turning the xxl-job server into a proxy for malicious network activity.

Attack Vector

The attack is network-accessible and requires low privileges (authenticated access) but no user interaction. An attacker with basic authenticated access to the xxl-job admin interface can craft specially formatted requests that exploit the SSRF vulnerability. The attack flow typically involves:

1. Authenticating to the xxl-job admin console with a low-privileged account
2. Identifying the vulnerable endpoint responsible for executor communication
3. Crafting a malicious request that redirects the server-side request to an attacker-controlled destination or internal resource
4. Leveraging the SSRF to interact with internal services or the executor component
5. Escalating the attack to achieve Remote Code Execution on executor nodes

For detailed technical analysis and proof-of-concept information, refer to the GitHub Issue Report documenting this vulnerability.

Detection Methods for CVE-2024-24113

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests originating from the xxl-job admin server to unexpected destinations
• Executor registration or communication attempts from unauthorized IP addresses or internal network segments
• Anomalous task execution patterns or job configurations created by low-privileged users
• Log entries showing requests to internal IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, 169.254.x.x) from the admin console

Detection Strategies

• Monitor xxl-job admin server network traffic for outbound connections to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254)
• Implement application-level logging to track all executor communication requests and validate expected destinations
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in request parameters
• Configure network segmentation alerts for any xxl-job admin server attempting to reach restricted network zones

Monitoring Recommendations

• Enable detailed access logging on the xxl-job admin console to capture all user actions and API requests
• Implement network-level monitoring for the xxl-job admin server with alerts for connections to non-whitelisted destinations
• Review executor registration logs regularly for unexpected or unauthorized executor instances
• Set up alerts for job execution failures or anomalies that could indicate exploitation attempts

How to Mitigate CVE-2024-24113

Immediate Actions Required

• Upgrade xxl-job to a version newer than 2.4.1 that addresses this SSRF vulnerability
• Implement strict network segmentation between the xxl-job admin console and executor nodes
• Review and restrict user privileges within xxl-job, applying the principle of least privilege
• Audit existing user accounts and remove any unnecessary low-privileged accounts that could be leveraged for exploitation

Patch Information

Organizations should upgrade xxl-job beyond version 2.4.1 to remediate this vulnerability. Check the official xxl-job GitHub repository for the latest security updates and release notes. Before upgrading, test the new version in a non-production environment to ensure compatibility with existing job configurations and executor deployments.

Workarounds

• Implement a whitelist of allowed executor addresses and validate all outbound requests against this whitelist
• Deploy network-level controls to restrict the xxl-job admin server from making connections to internal network ranges
• Configure a reverse proxy or WAF in front of the xxl-job admin console to filter and validate incoming requests
• Consider placing the xxl-job admin console in an isolated network segment with strict egress filtering

# Example: Network-level egress filtering using iptables
# Block xxl-job server from accessing internal networks (adjust for your environment)
iptables -A OUTPUT -s <xxl-job-admin-ip> -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -s <xxl-job-admin-ip> -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -s <xxl-job-admin-ip> -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -s <xxl-job-admin-ip> -d 169.254.169.254 -j DROP