6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-39954

CVE-2024-39954: Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-39954

CVE-2024-39954:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.eventmesh:eventmesh-runtime	maven	>= 1.6.0-release, <= 1.11.0-release

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2024-39954, is a Server-Side Request Forgery (SSRF) found in the WebhookUtil.java file of Apache EventMesh. The analysis of the patch that fixes this vulnerability reveals that the entire webhook functionality was deprecated and removed. The root cause of the SSRF is the obtainDeliveryAgreement method in the WebhookUtil class. This method makes an HTTP OPTIONS request to a user-provided URL during the webhook subscription process without adequate validation to prevent requests to internal or restricted network resources. An attacker could exploit this by crafting a subscription request with a URL pointing to an internal service, thereby tricking the EventMesh server into making a request to that service.

The vulnerable functions identified are:

org.apache.eventmesh.runtime.util.WebhookUtil.obtainDeliveryAgreement: This is the core vulnerable function that performs the SSRF attack by sending an HTTP request to an unchecked targetUrl.
org.apache.eventmesh.runtime.core.protocol.http.processor.LocalSubscribeEventProcessor.handler: This function is an entry point for the vulnerability. It takes a URL from a local subscription request and passes it to the vulnerable obtainDeliveryAgreement function.
org.apache.eventmesh.runtime.core.protocol.http.processor.SubscribeProcessor.processRequest: This is another entry point that handles general subscription requests and similarly calls the vulnerable obtainDeliveryAgreement function with the user-provided URL.

The fix applied by the developers was to remove the entire webhook feature, as evidenced by the deletion of numerous files and classes related to webhooks in commit 3ca1700d1336d41bd4fb1a3cf5378f98749a4e64. This effectively eliminates the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.