CVE-2024-6922

MEDIUMNuclei

Server-Side Request Forgery in Automation 360

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6922 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 26, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Automation 360

Browse Automationanywhere / Automation 360

Default status: unaffected

CVE List21 to ≤ 32affected

Nuclei templates

1
ProjectDiscoveryHIGHAutomation Anywhere Automation 360 - Server-Side Request Forgery

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component.

Impact

An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

AuthorsDhiyaneshDK
Template tagscvecve2024ssrfoastautomationanywherevuln
CPE: cpe:2.3:a:automationanywhere:automation_360:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:-1005691603
FOFA: icon_hash="-1005691603"
https://www.automationanywhere.com/products/automation-360 https://www.rapid7.com/blog/post/2024/07/26/cve-2024-6922-automation-anywhere-automation-360-server-side-request-forgery/ https://nvd.nist.gov/vuln/detail/CVE-2024-6922

Source: ProjectDiscovery

References

2