अकाना एपीआई प्लेटफॉर्म में SSRF

The SSRF vulnerability in Akana API Platform allows an attacker to craft malicious requests that the server will execute on their behalf. This can be exploited to access internal services and resources that are not directly exposed to the internet, such as internal databases, configuration files, or administrative interfaces. An attacker could potentially read sensitive data, modify configurations, or even gain control of the underlying infrastructure. The impact is particularly severe if the API Platform is used to manage sensitive data or integrate with critical internal systems. Successful exploitation could lead to a complete compromise of the API Platform and potentially the entire network.

Organizations utilizing Akana API Platform for managing APIs, particularly those with sensitive data or integrations with internal systems, are at risk. Environments with older, unpatched versions of the platform (prior to 2022.1.3) are especially vulnerable.

1. 2024-04-18Disclosure

   disclosure

1. आरक्षित2024-03-21
2. प्रकाशित2024-04-18
3. संशोधित2024-09-17
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-2796 is to upgrade to Akana API Platform version 2024.1.0 or later, which contains the fix. If upgrading immediately is not possible, consider implementing temporary workarounds such as restricting outbound network access from the API Platform to only necessary destinations. Implement strict input validation and sanitization to prevent attackers from manipulating the request URLs. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter malicious requests. Monitor API Platform logs for unusual outbound requests that may indicate exploitation attempts.