CVE-2024-37818: Strapi Server-Side Request Forgery (SSRF)

CVE-2024-37818 Overview

CVE-2024-37818 is a reported Server-Side Request Forgery (SSRF) vulnerability affecting Strapi v4.24.4. The flaw resides in the /strapi.io/_next/image component. Attackers can craft GET requests to scan internal ports or retrieve sensitive information from systems reachable by the server. The vulnerability is classified under [CWE-918] Server-Side Request Forgery.

The Strapi Development Community disputes this issue. They argue the flaw pertains only to the strapi.io marketing website and does not affect applications built with the Strapi library. Security teams running Strapi-based applications should evaluate this advisory in that context.

Critical Impact
A network-reachable attacker can abuse the _next/image endpoint to perform SSRF requests without authentication, potentially exposing internal services and metadata.

Affected Products

Strapi 4.24.4
Component: /strapi.io/_next/image
Vendor: strapi

Discovery Timeline

2024-06-20 - CVE-2024-37818 published to the National Vulnerability Database
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-37818

Vulnerability Analysis

The vulnerability targets the Next.js image optimization endpoint exposed at /strapi.io/_next/image. This endpoint accepts a remote URL parameter and fetches the referenced resource server-side to optimize and return it as an image. When input validation on the URL parameter is insufficient, an attacker can substitute internal addresses or arbitrary protocol targets.

The Strapi maintainers contend that the affected component belongs to the public strapi.io website rather than the strapi/admin package shipped to users. Applications consuming the Strapi library do not expose /strapi.io/_next/image and are therefore not directly impacted by this finding.

Root Cause

The root cause is insufficient validation of the URL parameter passed to the Next.js image proxy. The handler fetches the supplied URL without restricting it to an allowlist of trusted hosts or blocking private network ranges. This allows the server to act as a proxy for attacker-controlled requests.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker issues a crafted HTTP GET request to the _next/image endpoint with a url parameter pointing to an internal host, cloud metadata endpoint, or arbitrary external service. The server then performs the outbound request and may return response data or expose timing differences usable for port scanning.

See the Medium write-up on SSRF in Strapi for proof-of-concept details. No verified exploit code is published in public exploit databases.

Detection Methods for CVE-2024-37818

Indicators of Compromise

Inbound HTTP GET requests to /_next/image containing url parameters that reference RFC1918 ranges, 127.0.0.1, 169.254.169.254, or non-image protocols.
Outbound connections originating from the Strapi or Next.js host to internal services that the application does not normally contact.
Repeated requests to the same image endpoint with sequential host or port values, indicating port scanning behavior.

Detection Strategies

Inspect web server and reverse proxy logs for _next/image requests with externally controlled url query parameters.
Correlate inbound image-optimization requests with outbound network flows from the application host to identify unexpected destinations.
Apply WAF rules that flag requests where the url parameter resolves to private IP space or cloud metadata addresses.

Monitoring Recommendations

Forward Strapi access logs and host network telemetry to a centralized analytics platform for correlation against SSRF patterns.
Alert on any outbound traffic from the Strapi service to cloud instance metadata endpoints such as 169.254.169.254.
Baseline normal image-proxy destinations and trigger alerts on deviation from that allowlist.

How to Mitigate CVE-2024-37818

Immediate Actions Required

Confirm whether your deployment exposes the /strapi.io/_next/image route. The Strapi maintainers state this endpoint exists only on the marketing site, not in the strapi/admin package.
If running a custom Next.js front end that proxies images, restrict the images.domains or images.remotePatterns allowlist in next.config.js to trusted hosts only.
Place the application behind a reverse proxy that blocks outbound requests to private IP ranges and cloud metadata services.

Patch Information

No vendor patch has been published for CVE-2024-37818 because Strapi disputes the validity of the report against the strapi/admin package. Refer to the Strapi official website for current release notes and any future security advisories.

Workarounds

Configure Next.js image optimization with an explicit remotePatterns allowlist that excludes wildcard hosts.
Deploy egress filtering at the network layer to deny traffic from the application host to RFC1918 and link-local ranges.
Disable the Next.js image optimization endpoint entirely if it is not required by the application.

bash

# next.config.js example restricting image proxy targets
module.exports = {
  images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: 'cdn.example.com',
        pathname: '/**',
      },
    ],
  },
};