CVE-2024-4851: Quivr SSRF Vulnerability

CVE-2024-4851 Overview

CVE-2024-4851 is a Server-Side Request Forgery (SSRF) vulnerability in the stangirard/quivr application version 0.0.204. The flaw resides in the crawl_endpoint function within backend/routes/crawl_routes.py. Attackers can manipulate the url parameter to force the server to issue HTTP requests to arbitrary destinations, including internal-only services. This exposes internal networks, metadata endpoints, and other services reachable from the Quivr host to authenticated remote attackers. The issue maps to CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot through the Quivr backend to reach internal services, potentially exposing sensitive metadata, admin interfaces, or unauthenticated internal APIs.

Affected Products

Quivr 0.0.204
Deployments exposing the crawl endpoint to authenticated users
Self-hosted Quivr instances with access to internal network resources

Discovery Timeline

2024-06-06 - CVE-2024-4851 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4851

Vulnerability Analysis

Quivr exposes a crawl feature that fetches remote documents for ingestion into its knowledge base. The crawl_endpoint function in backend/routes/crawl_routes.py accepts a user-supplied url parameter and passes it directly to an HTTP client without validating the scheme, host, or resolved IP address. An authenticated attacker can submit URLs targeting private address ranges, loopback interfaces, or cloud metadata services. The server-side HTTP client honors those requests and returns response data or side effects to the caller. Because Quivr operates as a server-side component, requests originate from a trusted network position, bypassing perimeter controls that would normally block such access.

Root Cause

The root cause is missing input validation and network egress restrictions on the url parameter. The endpoint does not enforce an allowlist of permitted hosts, does not block private or link-local IP ranges (RFC 1918, 127.0.0.0/8, 169.254.169.254), and does not restrict the URL scheme to http/https for public destinations only. DNS resolution is not re-checked after redirect handling, which enables DNS rebinding style bypasses.

Attack Vector

Exploitation requires network access to the Quivr application and low-privilege authenticated access. The attacker sends a crafted request to the crawl endpoint with a url parameter pointing to an internal resource such as http://127.0.0.1:8080/admin, http://169.254.169.254/latest/meta-data/ on AWS, or an internal service on a private subnet. The Quivr backend issues the outbound request and processes the response. Attackers can enumerate internal hosts, fingerprint services, and in some deployments retrieve cloud instance credentials. The scope is changed because the vulnerable component acts on behalf of resources beyond its own security boundary.

See the Huntr bug bounty disclosure for the researcher-provided technical details.

Detection Methods for CVE-2024-4851

Indicators of Compromise

Application logs showing crawl requests where the url parameter targets 127.0.0.1, localhost, RFC 1918 ranges, or 169.254.169.254
Outbound HTTP connections from the Quivr backend to internal subnets that do not correspond to legitimate ingestion sources
Unexpected access patterns to cloud metadata endpoints originating from the Quivr host

Detection Strategies

Inspect reverse-proxy and application logs for POST or GET requests to the crawl route containing suspicious URL values
Correlate egress network flows from the Quivr container or host with request timestamps in the application log
Alert on any crawl requests whose target resolves to a private, loopback, or link-local address

Monitoring Recommendations

Enable structured logging for the crawl_endpoint function, capturing the requesting user, source IP, and target URL
Forward Quivr application and network logs to a centralized analytics platform for retention and correlation
Add egress firewall telemetry to identify unexpected connections from application workloads to internal services

How to Mitigate CVE-2024-4851

Immediate Actions Required

Upgrade Quivr to a release later than 0.0.204 that addresses the SSRF issue in crawl_routes.py
Place the Quivr backend behind an egress proxy that blocks requests to private, loopback, and link-local IP ranges
Disable or restrict access to the crawl feature until a patched version is deployed
On cloud deployments, enforce IMDSv2 with hop-limit 1 to prevent metadata theft through SSRF

Patch Information

Review the vendor project on GitHub for versions released after 0.0.204 and apply the fix that validates the url parameter. Refer to the Huntr disclosure record for the associated remediation commit and vendor coordination details.

Workarounds

Introduce an allowlist of permitted crawl destinations at a reverse proxy in front of Quivr
Deploy Quivr in a network segment that has no route to internal management interfaces or cloud metadata services
Require additional authorization checks or admin roles to invoke the crawl endpoint

bash

# Example egress restriction using iptables to block SSRF targets from the Quivr host
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j REJECT
iptables -A OUTPUT -d 169.254.169.254 -p tcp -j REJECT