CVE-2024-5885: Quivr SSRF Vulnerability

CVE-2024-5885 Overview

CVE-2024-5885 is a Server-Side Request Forgery (SSRF) vulnerability in stangirard/quivr version 0.0.236. The application fails to apply sufficient validation when crawling user-supplied URLs, allowing attackers to coerce the server into making requests to internal network resources. Successful exploitation grants access to internal services, the AWS instance metadata endpoint, and Supabase data accessible from the host. The flaw is tracked under CWE-918: Server-Side Request Forgery and requires no authentication or user interaction.

Critical Impact
Unauthenticated attackers can pivot through the Quivr application to reach internal services, exfiltrate cloud instance credentials from AWS metadata, and capture sensitive Supabase data.

Affected Products

Quivr 0.0.236
Deployments using the affected crawler component
Cloud-hosted Quivr instances exposed to attacker-controlled URLs

Discovery Timeline

2024-06-27 - CVE-2024-5885 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5885

Vulnerability Analysis

Quivr is an open-source generative AI application that ingests external content through a built-in crawler. The crawler accepts user-supplied URLs and fetches their content for downstream processing. In version 0.0.236, the crawler does not restrict destination hosts, schemes, or IP ranges before issuing the outbound request.

An attacker submits a URL that resolves to an internal address such as 127.0.0.1, 10.0.0.0/8, or a cloud metadata host like 169.254.169.254. The Quivr backend issues the HTTP request from its own network position and returns response data into the application context. This converts the server into a proxy for attacker-controlled requests against systems the attacker cannot reach directly.

Root Cause

The root cause is missing allowlist enforcement and missing IP-range filtering in the URL ingestion path. The crawler trusts the supplied URL after basic parsing and does not block link-local, loopback, or RFC1918 destinations. No authentication is required to invoke the crawl, which removes any access-control barrier in front of the flaw.

Attack Vector

Exploitation occurs over the network. An attacker submits a crafted URL through the crawling functionality and observes the response data or its side effects. Useful targets include the AWS Instance Metadata Service at http://169.254.169.254/latest/meta-data/iam/security-credentials/, internal admin panels, and the Supabase API endpoint reachable from the application host. Returned IAM credentials enable further lateral movement inside the cloud account.

Technical details are documented in the Huntr Vulnerability Bounty report.

Detection Methods for CVE-2024-5885

Indicators of Compromise

Outbound requests from the Quivr backend to 169.254.169.254, 127.0.0.1, or RFC1918 ranges
Crawler job entries containing URLs targeting internal hostnames, cloud metadata endpoints, or non-HTTP schemes
Unexpected reads of iam/security-credentials/ paths in AWS metadata access logs
Anomalous Supabase API queries originating from the Quivr service identity

Detection Strategies

Inspect Quivr application logs for crawl requests whose target host resolves to private, loopback, or link-local addresses
Correlate egress proxy or VPC flow logs with Quivr process identifiers to surface SSRF-style traffic patterns
Alert on any access to the AWS Instance Metadata Service from application workloads that should not require IAM role refresh

Monitoring Recommendations

Enforce and monitor IMDSv2 on EC2 instances hosting Quivr, and alert on IMDSv1 fallback attempts
Track Supabase access logs for queries originating from the Quivr service account outside normal usage patterns
Capture and review crawler input URLs for schemes other than http and https, including file://, gopher://, and dict://

How to Mitigate CVE-2024-5885

Immediate Actions Required

Upgrade Quivr to a release later than 0.0.236 that addresses the SSRF in the crawler component
Rotate any AWS IAM credentials, Supabase service keys, and internal API tokens accessible from the Quivr host
Restrict outbound network access from the Quivr workload using egress firewall rules or a forward proxy
Enforce IMDSv2 with hop limit of 1 on cloud instances running Quivr

Patch Information

No vendor advisory URL is listed in the NVD record. Refer to the Huntr bounty disclosure and the upstream stangirard/quivr repository for fixed releases beyond version 0.0.236. Verify the deployed commit against the project's release notes before returning the service to production.

Workarounds

Place the Quivr backend behind an egress proxy that blocks requests to loopback, link-local, and RFC1918 destinations
Run the crawler in a network namespace or container that has no route to internal subnets or cloud metadata services
Add a reverse proxy rule to reject crawl submissions whose resolved IP falls into reserved ranges before they reach the application

bash

# Example egress restriction using iptables to block AWS metadata access
iptables -A OUTPUT -m owner --uid-owner quivr -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quivr -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quivr -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quivr -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner quivr -d 192.168.0.0/16 -j REJECT