Apache EventMesh Runtime: SSRF

Vulnerability

Overview

CVE-2024-39954 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) found in the eventmesh-runtime module of Apache EventMesh, specifically within the WebhookUtil.java file. The flaw exists because the application does not properly validate or restrict URLs that can be requested by the webhook functionality, enabling an attacker to craft requests that target internal systems [1].

Exploitation

An attacker can exploit this vulnerability by sending a malicious webhook request that causes the server to make HTTP requests to arbitrary internal or external resources. No authentication is required to trigger the SSRF, and the attack can be performed over the network. The vulnerable component runs on Windows, Linux, and macOS [1].

Impact

Successful exploitation allows an attacker to read sensitive data from internal services (e.g., cloud metadata endpoints, internal APIs) or to update internal resources, potentially leading to further compromise of the infrastructure [1].

Mitigation

The Apache EventMesh project has addressed this issue in version 1.12.0 and in the master branch. Users are strongly recommended to upgrade to the fixed version to prevent exploitation [1]. The project is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.