Skip to main content

CVE-2024-0510: CWE-918 Server-Side Request Forgery in HaoKeKeJi YiQiNiu

High
VulnerabilityCVE-2024-0510cvecve-2024-0510cwe-918
Published: Sat Jan 13 2024 (01/13/2024, 22:00:06 UTC)
Source: CVE
Vendor/Project: HaoKeKeJi
Product: YiQiNiu

Description

A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.

AI-Powered Analysis

AILast updated: 07/06/2025, 15:27:40 UTC

Technical Analysis

CVE-2024-0510 is a critical server-side request forgery (SSRF) vulnerability identified in the HaoKeKeJi YiQiNiu product, specifically affecting versions 3.0 and 3.1. The vulnerability resides in the http_post function within the /application/pay/controller/Api.php file. An attacker can manipulate the 'url' argument passed to this function, causing the server to make arbitrary HTTP requests to internal or external systems. This SSRF flaw allows an unauthenticated remote attacker to coerce the vulnerable server into sending crafted requests, potentially accessing internal services that are otherwise inaccessible from the outside. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity, with an attack vector of network (remote exploitation), low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Although no public exploits are currently known in the wild, the vulnerability details have been disclosed, increasing the risk of exploitation. SSRF vulnerabilities like this can be leveraged to perform reconnaissance of internal networks, access sensitive metadata services, exploit trust relationships, or pivot to other internal systems, potentially leading to data leakage, unauthorized actions, or denial of service. The lack of an official patch at the time of disclosure means affected organizations must rely on mitigation strategies until an update is released.

Potential Impact

For European organizations using HaoKeKeJi YiQiNiu versions 3.0 or 3.1, this SSRF vulnerability poses significant risks. Financial and payment processing systems are often critical infrastructure, and exploitation could lead to unauthorized internal network access, data exfiltration, or disruption of payment services. Confidential customer data and transaction details could be exposed or manipulated, undermining data protection compliance obligations such as GDPR. The ability to send arbitrary requests from the server may also allow attackers to reach internal administrative interfaces or cloud metadata endpoints, potentially escalating the attack to full system compromise. The impact extends beyond confidentiality to integrity and availability, threatening operational continuity and trust. Given the criticality of payment systems, even temporary service disruption could have severe financial and reputational consequences for European businesses and their customers.

Mitigation Recommendations

Immediate mitigation should focus on restricting the ability of the vulnerable http_post function to make arbitrary outbound requests. Network-level controls such as egress filtering and firewall rules should be implemented to limit outbound HTTP requests from the application server to only trusted endpoints. Application-level input validation must be enforced to sanitize and strictly validate the 'url' parameter, allowing only known safe URLs or domains. If possible, disable or isolate the vulnerable functionality until a vendor patch is available. Monitoring and logging outbound requests from the application can help detect suspicious activity indicative of exploitation attempts. Organizations should also conduct internal network segmentation to minimize the impact of SSRF attacks and review access controls on internal services. Finally, maintain close communication with the vendor for timely patch releases and apply updates promptly once available.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
VulDB
Date Reserved
2024-01-12T19:13:38.339Z
Cisa Enriched
true
Cvss Version
3.1
State
PUBLISHED

Threat ID: 682cd0fb1484d88663aeca21

Added to database: 5/20/2025, 6:59:07 PM

Last enriched: 7/6/2025, 3:27:40 PM

Last updated: 8/10/2025, 2:42:05 PM

Views: 13

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats