Cyber Posture

CVE-2024-57767

HighPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0025 48.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57767 is a high-severity SSRF (CWE-918) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of inputs to the /file/download component to block malicious URLs or parameters that enable SSRF.

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow control policies to restrict the server from initiating unauthorized requests to internal or external resources via SSRF.

SC-7 Boundary Protection partial match
preventdetect

Implements boundary protection to monitor and control communications, limiting SSRF exploitation by blocking access to protected internal networks.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1552.005 Cloud Instance Metadata API Credential Access
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

SSRF in /file/download allows authenticated attackers to force server requests to arbitrary URLs (http/file/etc.), enabling exploitation of the web application, internal network service/port discovery, cloud metadata API access, and local system data collection.

NVD Description

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.

Deeper analysisAI

CVE-2024-57767 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting MSFM versions prior to v2025.01.01. The issue resides in the /file/download component, as disclosed on January 15, 2025, with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows attackers to induce the server to make unauthorized requests, potentially leading to high confidentiality impacts across a changed scope, such as accessing internal network resources.

The vulnerability is tracked in an advisory at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9. Mitigation requires upgrading to MSFM v2025.01.01 or later.

Details

CWE(s)
CWE-918

Affected Products

wangl1989
mysiteforme
≤ 2025-01-01

CVEs Like This One

CVE-2024-13139Same product: Wangl1989 Mysiteforme
CVE-2024-57763Same product: Wangl1989 Mysiteforme
CVE-2024-57762Same product: Wangl1989 Mysiteforme
CVE-2024-57766Same product: Wangl1989 Mysiteforme
CVE-2025-26136Same product: Wangl1989 Mysiteforme
CVE-2024-13138Same product: Wangl1989 Mysiteforme
CVE-2024-13136Same product: Wangl1989 Mysiteforme
CVE-2024-57764Same product: Wangl1989 Mysiteforme
CVE-2024-57765Same product: Wangl1989 Mysiteforme
CVE-2026-0560Shared CWE-918

References