Ruijie Reyee OS (Server-Side Request Forgery)

The vulnerability's impact is severe due to the ability to force arbitrary requests. An attacker could leverage this to bypass security controls and gain unauthorized access to internal resources. Specifically, the ability to access AWS cloud metadata services poses a significant risk, potentially exposing sensitive configuration data, credentials, and other information stored within Ruijie's internal cloud environment. This could lead to data breaches, system compromise, and further lateral movement within the network. The scope of the impact extends beyond the Reyee OS device itself, potentially affecting any systems or services accessible through the compromised proxy server.

Organizations utilizing Ruijie Reyee OS in their network infrastructure are at risk, particularly those relying on the proxy server for internet access and internal service routing. Environments with sensitive data or critical internal services are especially vulnerable. Shared hosting environments using Ruijie Reyee OS may also be affected, as the proxy server is a shared resource.

• windows / supply-chain: Monitor PowerShell execution for unusual proxy-related commands. Check scheduled tasks for suspicious proxy configurations. • linux / server: Examine journalctl logs for proxy errors or unusual outbound requests. Use ss or lsof to identify processes making unexpected connections through the proxy. • generic web: Monitor access and error logs for requests to unusual or unexpected destinations. Check response headers for signs of proxy manipulation.

1. 2024-12-06Disclosure

   disclosure

1. Reserviert2024-11-20
2. Veröffentlicht2024-12-06
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-48874 is to upgrade Ruijie Reyee OS to version 2.320.x or later. If immediate upgrading is not feasible, consider implementing temporary workarounds. These might include restricting outbound proxy connections to only trusted destinations, implementing stricter access controls on internal services, and monitoring proxy server logs for suspicious activity. Network segmentation can also limit the blast radius of a potential compromise. After upgrading, verify the fix by attempting to trigger the arbitrary request vulnerability and confirming that it is no longer exploitable.