CVE-2024-7314: Anji-plus Report Auth Bypass Vulnerability

CVE-2024-7314 Overview

CVE-2024-7314 is a critical authentication bypass vulnerability affecting anji-plus AJ-Report, a popular open-source reporting tool. The vulnerability allows remote, unauthenticated attackers to bypass authentication mechanisms by appending ;swagger-ui to HTTP requests. Once authentication is bypassed, attackers can execute arbitrary Java code on the victim server, potentially leading to complete system compromise.

Critical Impact

Remote unauthenticated attackers can achieve arbitrary code execution by bypassing authentication controls through a simple URL manipulation technique. Evidence of active exploitation was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Affected Products

• anji-plus AJ-Report (all versions)
• Systems running the anji-plus report component (cpe:2.3:a:anji-plus:report:*:*:*:*:*:*:*:*)

Discovery Timeline

• 2024-08-02 - CVE-2024-7314 published to NVD
• 2025-02-05 - Exploitation evidence observed by Shadowserver Foundation
• 2025-11-20 - Last updated in NVD database

Technical Details for CVE-2024-7314

Vulnerability Analysis

This vulnerability stems from improper authentication bypass controls (CWE-288) in the AJ-Report application. The core issue lies in how the application processes URL paths when determining whether authentication is required. The authentication filter fails to properly validate request paths that contain the ;swagger-ui suffix, allowing attackers to access protected endpoints without valid credentials.

Once authentication is bypassed, attackers can leverage the application's functionality to execute arbitrary Java code on the server. This code execution capability transforms what would be a simple authentication bypass into a full remote code execution vulnerability, enabling attackers to gain complete control over the affected system.

The vulnerability is particularly dangerous because it requires no prior authentication, no user interaction, and can be exploited remotely over the network. The low complexity of exploitation combined with the high impact on confidentiality, integrity, and availability makes this a severe security risk for any organization running vulnerable versions of AJ-Report.

Root Cause

The root cause is a flaw in the URL path validation logic within the authentication filter. The application appears to whitelist certain paths related to Swagger UI documentation (commonly used for API documentation in Java applications). However, the implementation incorrectly allows the ;swagger-ui suffix to be appended to any URL path, effectively bypassing authentication for any endpoint.

This type of vulnerability often occurs when developers implement URL-based access control without properly considering how web servers and application frameworks parse URL paths. The semicolon character has special meaning in some URL parsing contexts, and this inconsistency can lead to security bypasses.

Attack Vector

The attack vector involves appending ;swagger-ui to HTTP requests targeting protected endpoints. For example, an attacker can access administrative or privileged endpoints that would normally require authentication by simply modifying the URL structure.

The attack flow proceeds as follows:

1. The attacker identifies a protected endpoint in the AJ-Report application
2. The attacker appends ;swagger-ui to the request URL
3. The authentication filter incorrectly identifies the request as targeting Swagger documentation
4. The request bypasses authentication and reaches the protected endpoint
5. The attacker can then exploit functionality that allows Java code execution

Technical details and proof-of-concept materials are available through the Vulhub PoC Repository, the AJ-Report Exploit Resource on GitHub, and the VulnCheck Advisory.

Detection Methods for CVE-2024-7314

Indicators of Compromise

• HTTP requests containing ;swagger-ui appended to unexpected URL paths
• Unusual Java process execution originating from the AJ-Report application
• Unauthorized access to administrative endpoints without valid session tokens
• Unexpected outbound network connections from the AJ-Report server
• Evidence of code execution or file system modifications in AJ-Report directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing ;swagger-ui in suspicious contexts
• Monitor HTTP access logs for URL patterns containing semicolon characters followed by authentication bypass attempts
• Deploy intrusion detection signatures that alert on the specific bypass pattern
• Review application logs for authentication failures followed by successful access to protected resources

Monitoring Recommendations

• Enable detailed HTTP request logging on servers running AJ-Report
• Configure security information and event management (SIEM) alerts for suspicious URL patterns
• Monitor for unexpected Java process spawning or code execution
• Implement network segmentation and monitor for lateral movement from AJ-Report servers

How to Mitigate CVE-2024-7314

Immediate Actions Required

• Immediately restrict network access to AJ-Report instances to trusted networks only
• Implement WAF rules to block requests containing ;swagger-ui bypass patterns
• Review access logs for evidence of exploitation attempts or successful breaches
• Consider taking vulnerable AJ-Report instances offline until patches can be applied

Patch Information

Organizations should monitor the official anji-plus repositories and security advisories for patch releases. Given the critical nature of this vulnerability and observed exploitation in the wild, applying patches should be treated as a high priority. Additional technical analysis is available from the Aliyun Security Analysis.

Workarounds

• Deploy a reverse proxy or WAF in front of AJ-Report to filter malicious requests
• Implement network-level access controls to restrict access to AJ-Report to authorized IP addresses only
• Disable Swagger UI functionality if not required for operations
• Use application-level firewall rules to block requests containing semicolon characters in URL paths

# Example nginx configuration to block bypass attempts
location / {
    # Block requests containing ;swagger-ui bypass pattern
    if ($request_uri ~* ";swagger-ui") {
        return 403;
    }
    proxy_pass http://aj-report-backend;
}