CVE-2024-48874: Ruijie Reyee OS SSRF Vulnerability

CVE-2024-48874 Overview

CVE-2024-48874 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Ruijie Reyee OS, a cloud-based network management platform used for managing network devices. The vulnerability allows unauthenticated remote attackers to force Ruijie's proxy servers to perform arbitrary HTTP requests on their behalf, potentially granting access to internal services and cloud infrastructure, including AWS cloud metadata services.

This flaw is particularly dangerous because it can be exploited to pivot through Ruijie's trusted infrastructure to reach otherwise protected backend services. Attackers leveraging this vulnerability could extract sensitive configuration data, cloud credentials, or internal API keys from metadata endpoints.

Critical Impact

Unauthenticated attackers can abuse Ruijie proxy servers to access internal cloud infrastructure and AWS metadata services, potentially compromising cloud credentials and sensitive backend systems.

Affected Products

• Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x
• ruijienetworks reyee_os

Discovery Timeline

• 2024-12-06 - CVE-2024-48874 published to NVD
• 2024-12-10 - Last updated in NVD database

Technical Details for CVE-2024-48874

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability exists in the Ruijie Reyee OS cloud management platform. The flaw allows attackers to manipulate the proxy functionality within the Reyee OS infrastructure, forcing the server to make arbitrary HTTP requests to destinations of the attacker's choosing.

The core issue stems from insufficient validation of user-supplied URLs or request parameters when the system processes proxy requests. Because Ruijie's proxy servers are trusted components within their network architecture, requests originating from these servers can bypass security controls that would otherwise block external access to internal services.

A particularly severe consequence of this vulnerability is the ability to access AWS cloud metadata services (typically at http://169.254.169.254). This metadata endpoint can expose temporary IAM credentials, instance configuration details, and other sensitive cloud environment data. An attacker who successfully retrieves AWS credentials could potentially escalate access to other cloud resources.

Root Cause

The root cause of CVE-2024-48874 is classified under CWE-918: Server-Side Request Forgery (SSRF). This weakness occurs when the application fails to properly validate or sanitize user-controlled input that specifies the destination of outbound HTTP requests. In this case, the Ruijie Reyee OS proxy functionality does not adequately restrict which internal or external resources can be accessed through the proxy mechanism, allowing attackers to redirect requests to arbitrary targets including internal services and cloud metadata endpoints.

Attack Vector

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. An attacker can craft malicious requests to the Reyee OS management interface, specifying internal network addresses or cloud metadata service endpoints as the target. The proxy server will then make the request on behalf of the attacker and return the response.

Common attack scenarios include:

• Accessing AWS Instance Metadata Service (IMDS) at 169.254.169.254 to retrieve IAM credentials
• Scanning internal network infrastructure through the proxy
• Accessing internal APIs and administrative interfaces that are not exposed to the internet
• Retrieving configuration files and secrets from internal services

Detection Methods for CVE-2024-48874

Indicators of Compromise

• Unusual outbound requests from Reyee OS proxy servers to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests targeting AWS metadata endpoint 169.254.169.254 from proxy infrastructure
• Anomalous access patterns to internal services originating from trusted proxy components
• Unexpected API calls using cloud credentials that may have been harvested via SSRF

Detection Strategies

• Monitor network traffic logs for requests to cloud metadata service IP addresses (169.254.169.254)
• Implement web application firewall (WAF) rules to detect SSRF attempt patterns in request parameters
• Review proxy server logs for requests to internal network addresses or localhost
• Deploy network segmentation monitoring to detect lateral movement from proxy servers to internal services

Monitoring Recommendations

• Enable verbose logging on Reyee OS management interfaces and proxy components
• Configure alerts for any requests to RFC1918 private address ranges from the proxy layer
• Monitor AWS CloudTrail logs for suspicious API activity using compromised credentials
• Implement network flow monitoring to detect unauthorized internal reconnaissance

How to Mitigate CVE-2024-48874

Immediate Actions Required

• Upgrade Ruijie Reyee OS to version 2.320.x or later immediately
• Restrict network access to the Reyee OS management interface to trusted IP ranges
• Implement network-level controls to block proxy servers from accessing AWS metadata endpoints
• Review AWS IAM roles and implement IMDSv2 with hop limit restrictions to reduce metadata service exposure

Patch Information

Ruijie Networks has addressed this vulnerability in Reyee OS version 2.320.x. Organizations should consult the CISA ICS Advisory ICSA-24-338-01 for detailed patching guidance and additional mitigation recommendations. All deployments running versions between 2.206.x and 2.320.x should be upgraded as a priority.

Workarounds

• Implement network segmentation to isolate Reyee OS proxy infrastructure from sensitive internal services
• Configure AWS IMDS to require session tokens (IMDSv2) and set appropriate hop limits to mitigate credential theft
• Deploy egress filtering on proxy servers to block requests to internal IP ranges and metadata endpoints
• Use firewall rules to restrict the proxy's ability to initiate connections to non-essential destinations
• Monitor and alert on any SSRF-like request patterns while awaiting patch deployment