Quick answers
- Is CVE-2024-37818 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-37818 being exploited in the wild.
- How severe is CVE-2024-37818?
- Low severity, with a CVSS score of 3.1, published 20 June 2024.
- Which products and versions are affected?
- Strapi Strapi 4.24.4.
- Is there a fix for CVE-2024-37818?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-37818 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-37818?
- Check whether you run @strapi/strapi (npm). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Strapi v4.24.4, specifically in the /_next/image endpoint. The vulnerability is rooted in insufficient input validation on image URL parameters, allowing attackers to craft GET requests that cause the server to make arbitrary HTTP requests to internal or external targets. This is a network-accessible vulnerability requiring no authentication or user interaction. An attacker can exploit this to perform port scanning on internal networks, access internal services (databases, cloud metadata endpoints, administrative interfaces), or retrieve sensitive information. The vulnerability is classified as CWE-918 (SSRF). A fix is expected in a patched version of Strapi.
Affected products
- Strapi Strapi 4.24.4
Identifiers
- CVE-2024-37818
- GHSA-p9ff-j98v-p435
Timeline
- 2024-06-20: disclosed
- 2024-10-04: other: GitHub reviewed