CVE-2024-13195

MediumPublic PoC

Published: 09 January 2025

Published

09 January 2025

Modified

22 August 2025

KEV Added

—

Patch

—

CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0008 22.5th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13195 is a medium-severity SSRF (CWE-918) vulnerability in Donglight Bookstore. Its CVSS base score is 6.3 (Medium).

Operationally, ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates and sanitizes the manipulated 'url' argument in the getHtml function to prevent SSRF exploitation.

SC-7 Boundary Protection good match

prevent

Monitors and controls outbound network communications at system boundaries to block unauthorized server-initiated requests from SSRF.

AC-4 Information Flow Enforcement good match

prevent

Enforces information flow control policies restricting the getHtml function from accessing unauthorized internal or external resources via forged URLs.

NVD Description

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the…

attack remotely. The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2024-13195 is a server-side request forgery (SSRF) vulnerability, classified as critical, in the donglight bookstore e-commerce book city system version 1.0.0. The flaw affects the getHtml function in the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java, where manipulation of the url argument triggers the SSRF. It is remotely exploitable and associated with CWE-918, with a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An authenticated attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables SSRF, potentially allowing the attacker to make unauthorized requests from the server, resulting in low impacts to confidentiality, integrity, and availability.

Advisories are available via the project's GitHub issues at https://github.com/donglight/bookstore/issues/11 and VulDB entries including https://vuldb.com/?id.290787. The exploit has been publicly disclosed and may be used.

The vulnerability was published on 2025-01-09.