CVE-2024-24806 Improper Domain Lookup that potentially leads to SSRF attacks in libuv
Attackers can exploit hostname truncation in libuv to bypass security checks and perform Server-Side Request Forgery attacks against internal services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24806?
CVE-2024-24806 is a high-severity server-side request forgery vulnerability in libuv, published on 7 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2024-24806?
It affects 1 product.
Linux distribution packages (30)
libuv AlmaLinux:8 | All versions | 1:1.41.1-2.el8_10 |
libuv-devel AlmaLinux:8 | All versions | 1:1.41.1-2.el8_10 |
libuv AlmaLinux:9 | All versions | 1:1.42.0-2.el9_4 |
libuv-devel AlmaLinux:9 | All versions | 1:1.42.0-2.el9_4 |
libuv Red Hat:enterprise_linux:8::appstream | All versions | 1:1.41.1-2.el8_10 |
libuv-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.41.1-2.el8_10 |
libuv-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:1.41.1-2.el8_10 |
libuv-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:1.41.1-2.el8_10 |
libuv-debugsource Red Hat:enterprise_linux:8::crb | All versions | 1:1.41.1-2.el8_10 |
libuv-devel Red Hat:enterprise_linux:8::crb | All versions | 1:1.41.1-2.el8_10 |
libuv Red Hat:enterprise_linux:9::appstream | All versions | 1:1.42.0-2.el9_4 |
libuv-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:1.42.0-2.el9_4 |
libuv-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:1.42.0-2.el9_4 |
libuv-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 1:1.42.0-2.el9_4 |
libuv-debugsource Red Hat:enterprise_linux:9::crb | All versions | 1:1.42.0-2.el9_4 |
libuv-devel Red Hat:enterprise_linux:9::crb | All versions | 1:1.42.0-2.el9_4 |
libuv Red Hat:rhel_eus:8.8::appstream | All versions | 1:1.41.1-1.el8_8.1 |
libuv-debuginfo Red Hat:rhel_eus:8.8::appstream | All versions | 1:1.41.1-1.el8_8.1 |
libuv-debugsource Red Hat:rhel_eus:8.8::appstream | All versions | 1:1.41.1-1.el8_8.1 |
libuv-debuginfo Red Hat:rhel_eus:8.8::crb | All versions | 1:1.41.1-1.el8_8.1 |
libuv-debugsource Red Hat:rhel_eus:8.8::crb | All versions | 1:1.41.1-1.el8_8.1 |
libuv-devel Red Hat:rhel_eus:8.8::crb | All versions | 1:1.41.1-1.el8_8.1 |
libuv Rocky Linux:8 | All versions | 1:1.41.1-2.el8_10 |
libuv Rocky Linux:9 | All versions | 1:1.42.0-2.el9_4 |
libuv SUSE:Linux Enterprise Micro 5.5 | All versions | 1.44.2-150500.3.5.1 |
libuv SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.44.2-150500.3.5.1 |
libuv SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.44.2-150500.3.5.1 |
libuv openSUSE:Leap 15.5 | All versions | 1.44.2-150500.3.5.1 |
libuv openSUSE:Leap 15.6 | All versions | 1.44.2-150500.3.5.1 |
libuv openSUSE:Tumbleweed | All versions | 1.48.0-1.1 |
Products include Libuv Libuv.
How do I fix CVE-2024-24806?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-24806 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24806 exists.
Other vulnerabilities in libuv
Sources
Also known as ALPINE-CVE-2024-24806, ALSA-2024:4247, ALSA-2024:4756, AZL-34278, AZL-34306, AZL-34957 and 23 more.