Cyber Posture

CVE-2024-57767

HighPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0025 48.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2024-57767 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting MSFM versions prior to v2025.01.01. The issue resides in the /file/download component, as disclosed on January 15, 2025, with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows attackers to induce the server to make unauthorized requests, potentially leading to high confidentiality impacts across a changed scope, such as accessing internal network resources.

The vulnerability is tracked in an advisory at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9. Mitigation requires upgrading to MSFM v2025.01.01 or later.

Details

CWE(s)
CWE-918

Affected Products

wangl1989
mysiteforme
≤ 2025-01-01

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1552.005 Cloud Instance Metadata API Credential Access
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

SSRF in /file/download allows authenticated attackers to force server requests to arbitrary URLs (http/file/etc.), enabling exploitation of the web application, internal network service/port discovery, cloud metadata API access, and local system data collection.

References