CVE-2024-6922: Automation Anywhere SSRF Vulnerability

CVE-2024-6922 Overview

CVE-2024-6922 is a Server-Side Request Forgery (SSRF) vulnerability affecting Automation Anywhere Automation 360 versions 21 through 32. The flaw resides in a web API component exposed by the Control Room service. An unauthenticated attacker who can reach the Control Room over HTTPS (port 443) or HTTP (port 80) can coerce the server into issuing arbitrary outbound web requests. This exposure enables attackers to pivot through the Control Room to reach internal systems, cloud metadata endpoints, or other resources reachable from the host. The vulnerability is tracked under CWE-918.

Critical Impact
Unauthenticated network attackers can force the Control Room to issue arbitrary HTTP requests, enabling internal network reconnaissance and access to otherwise unreachable services.

Affected Products

Automation Anywhere Automation 360 v21
Automation Anywhere Automation 360 v22 through v31
Automation Anywhere Automation 360 v32

Discovery Timeline

2024-07-26 - CVE-2024-6922 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-6922

Vulnerability Analysis

The vulnerability exists in a web API component of the Automation 360 Control Room. The component accepts a user-controlled URL or host parameter and dispatches a server-side HTTP request without sufficient validation of the destination. Because the request originates from the Control Room server, it inherits the server's network position and any implicit trust granted by internal services.

The attack does not require authentication. An attacker only needs network reachability to the Control Room over port 80 or 443. The EPSS score of 32.59% places this issue in the 96.92 percentile for predicted exploitation activity, indicating elevated interest relative to most CVEs.

Root Cause

The root cause is missing or insufficient validation of destination URLs supplied to a web API endpoint. The component fetches user-supplied URLs server-side without enforcing an allowlist of hosts, restricting URL schemes, or blocking internal IP ranges and link-local metadata addresses. This pattern matches CWE-918: Server-Side Request Forgery.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP or HTTPS request to the Control Room API endpoint. The request includes a target URL that the server then fetches. Attackers commonly use this primitive to probe internal services, query cloud instance metadata endpoints such as 169.254.169.254, enumerate ports on internal hosts, or interact with internal HTTP APIs that bind only to private interfaces. The response data, response timing, or differential error behavior leaks information about reachable internal resources.

No verified public exploit code was identified at publication. The vulnerability is described in prose only — see the Automation Anywhere Product Overview and the vendor advisory for technical specifics.

Detection Methods for CVE-2024-6922

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from the Control Room server to internal RFC1918 addresses that do not match normal automation traffic patterns.
Control Room access logs showing unauthenticated requests to the affected web API component with URL-like parameters in the query string or body.
Outbound connections from the Control Room host to cloud metadata addresses such as 169.254.169.254 or metadata.google.internal.

Detection Strategies

Inspect Control Room HTTP access logs for repeated unauthenticated requests to API endpoints carrying URL-style parameters.
Correlate web server logs with outbound proxy or firewall logs to surface server-initiated requests that follow inbound API calls.
Alert on any process on the Control Room host opening sockets to internal management ranges or metadata services outside expected automation workflows.

Monitoring Recommendations

Forward Control Room application logs and host network telemetry to a centralized analytics platform for retention and correlation.
Baseline the set of external and internal destinations the Control Room normally contacts, then alert on deviations.
Monitor for sudden increases in outbound request volume or response sizes from the Control Room host.

How to Mitigate CVE-2024-6922

Immediate Actions Required

Restrict network access to the Control Room HTTP and HTTPS ports so only trusted management networks and required automation clients can reach them.
Block egress from the Control Room host to cloud metadata IPs and to internal management networks that the application does not need.
Review Control Room access logs for the past several months for anomalous unauthenticated requests to API endpoints.

Patch Information

Apply the fixed Automation 360 release published by Automation Anywhere for versions 21 through 32. Refer to the Automation Anywhere Product Overview and the vendor's security advisory portal for the specific patched build numbers that correspond to your deployed version.

Workarounds

Place the Control Room behind a reverse proxy or web application firewall that strips or validates URL parameters submitted to the affected API.
Enforce strict egress filtering on the Control Room host using host-based or network firewalls to deny outbound traffic to internal address ranges and metadata services.
Require authentication at the network perimeter using mTLS or VPN access until the patched version is deployed.

bash

# Example iptables egress restriction blocking cloud metadata and RFC1918 destinations
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP