CVE-2024-6922

published 2024-07-26

CVE-2024-6922: Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the…

Priority P2 61 medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
automationanywhere	automation_360	21 – 32	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /v1/proxy/test HTTP/1.1

path /v1/proxy/test

port 443↗

other http.favicon.hash:-1005691603

other icon_hash="-1005691603"

command {"saasUrl":"{{interactsh-url}}/?param=one#"}

• → Exploit sends an unauthenticated POST request to /v1/proxy/test with a JSON body containing a 'saasUrl' key pointing to an attacker-controlled URL, triggering SSRF.
• → Successful exploitation returns HTTP 400 with a JSON body containing '{"message":' and Content-Type: application/json — monitor for this pattern on /v1/proxy/test.
• → Out-of-band DNS interaction is the primary confirmation of SSRF exploitation; monitor for unexpected DNS lookups originating from the Automation 360 Control Room server.
• → Identify Automation Anywhere Automation 360 Control Room instances via Shodan favicon hash -1005691603 or FOFA icon_hash="-1005691603".
• → The vulnerability is unauthenticated — no session token or credentials are required in the POST request to /v1/proxy/test. ↗

• · Affected versions are Automation 360 v21 through v32 only; instances outside this range are not vulnerable. ↗
• · The SSRF endpoint /v1/proxy/test requires no authentication, meaning network-level controls (firewall rules blocking ports 80/443 to untrusted clients) are the primary mitigation layer until patching. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918