CVE-2024-57767

HighPublic PoC

Published: 15 January 2025

Published

15 January 2025

Modified

10 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0034 57.5th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57767 is a high-severity SSRF (CWE-918) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57767 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting MSFM versions prior to v2025.01.01. The issue resides in the /file/download component, as disclosed on January 15, 2025, with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows attackers to induce the server to make unauthorized requests, potentially leading to high confidentiality impacts across a changed scope, such as accessing internal network resources.

The vulnerability is tracked in an advisory at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9. Mitigation requires upgrading to MSFM v2025.01.01 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53735

Vulnerability details

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.

CWE(s): CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

T1552.005 Cloud Instance Metadata API Credential Access

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

SSRF in /file/download allows authenticated attackers to force server requests to arbitrary URLs (http/file/etc.), enabling exploitation of the web application, internal network service/port discovery, cloud metadata API access, and local system data collection.