CVE-2024-6922: Automation 360 SSRF Vulnerability

CVE-2024-6922 Overview

CVE-2024-6922 is a Server-Side Request Forgery (SSRF) vulnerability affecting Automation Anywhere Automation 360 versions 21 through 32. The flaw exists in a web API component that allows an attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) to trigger arbitrary web requests from the server.

Critical Impact

Unauthenticated attackers can abuse the vulnerable web API to make the server send arbitrary HTTP requests, potentially accessing internal services, cloud metadata endpoints, or pivoting to other systems within the network.

Affected Products

• Automation Anywhere Automation 360 v21
• Automation Anywhere Automation 360 v22-v31
• Automation Anywhere Automation 360 v32

Discovery Timeline

• 2024-07-26 - CVE-2024-6922 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6922

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a web application vulnerability that allows attackers to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. In the context of Automation Anywhere Automation 360, the vulnerability exists within a web API component accessible through the Control Room service.

The SSRF vulnerability is particularly concerning because it requires no authentication to exploit. An attacker only needs network access to the Control Room's HTTP (port 80) or HTTPS (port 443) services. Once exploited, the attacker can leverage the server's trusted network position to access internal resources that would otherwise be unreachable from external networks.

Root Cause

The root cause of this vulnerability lies in insufficient validation and sanitization of user-supplied URLs within the web API component. The application fails to properly restrict the destinations of server-side HTTP requests, allowing attackers to specify arbitrary URLs that the server will fetch on their behalf.

This type of vulnerability typically occurs when:

• User input is directly used to construct URLs for server-side requests
• There is no allowlist of permitted destination hosts
• Internal/private IP ranges are not blocked
• URL parsing is inconsistent between validation and request execution

Attack Vector

The attack vector for CVE-2024-6922 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying the vulnerable API endpoint on the Automation 360 Control Room
2. Crafting malicious requests containing attacker-controlled URLs
3. Submitting requests to trigger server-side fetches to internal resources

Common SSRF exploitation scenarios include:

• Accessing cloud provider metadata services (e.g., http://169.254.169.254/ on AWS/Azure/GCP)
• Port scanning internal networks
• Accessing internal APIs and services
• Bypassing firewall restrictions
• Exfiltrating sensitive data from internal systems

Due to the absence of verified code examples, organizations should refer to the Automation Anywhere Product Overview for additional technical context and vendor guidance on this vulnerability.

Detection Methods for CVE-2024-6922

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from the Automation 360 Control Room server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Requests to cloud metadata endpoints such as 169.254.169.254 originating from the Control Room
• Unexpected DNS queries from the Control Room server to internal hostnames or external attacker-controlled domains
• Web server logs showing API requests with URL parameters containing internal addresses or localhost references

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in API requests to the Control Room
• Implement network-level monitoring to alert on outbound connections from the Control Room to internal network segments it shouldn't normally access
• Enable detailed logging for all Control Room API endpoints and correlate with network flow data
• Use SentinelOne Singularity Platform to monitor for anomalous process behavior and network connections from the Automation 360 application

Monitoring Recommendations

• Configure alerts for Control Room processes initiating connections to RFC 1918 private IP addresses or link-local addresses
• Monitor DNS logs for resolution requests to internal hostnames from the Control Room server
• Establish baseline network behavior for the Control Room and alert on deviations
• Review web server access logs for suspicious URL patterns in API request parameters

How to Mitigate CVE-2024-6922

Immediate Actions Required

• Restrict network access to the Automation 360 Control Room (ports 80 and 443) to only authorized users and systems
• Implement network segmentation to limit the Control Room's ability to reach sensitive internal services
• Deploy a web application firewall (WAF) in front of the Control Room with SSRF protection rules enabled
• Contact Automation Anywhere support to obtain patching guidance and updated software versions

Patch Information

Organizations should check with Automation Anywhere for available security updates addressing this vulnerability. Review the Automation Anywhere Product Overview and contact vendor support for the latest security patches applicable to your installed version (v21-v32).

Workarounds

• Implement strict network egress filtering to prevent the Control Room from making outbound requests to internal network ranges and cloud metadata endpoints
• Use network access control lists (ACLs) to restrict which systems can reach the Control Room's web services
• Deploy a reverse proxy in front of the Control Room that sanitizes and validates all incoming requests before forwarding
• If the vulnerable API endpoint is not business-critical, consider disabling it until a patch is available

# Example: Block outbound requests to internal networks from Control Room server using iptables
# Adjust interface and IP ranges according to your environment

# Block access to common internal ranges
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner automation360 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner automation360 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner automation360 -j DROP

# Block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner automation360 -j DROP