dbcve.org
Server-Side Request Forgery (SSRF)Weakness · CWE-918

CVE-2024-25738

CRITICAL · 9.1 CVSS v3.1 Published 2024-05-22
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route of VuFind versions 2.0 through 9.1 before 9.1.1 allows remote attackers to overwrite local configuration files, potentially gaining administrator panel access and achieving Remote Code Execution.

MitigationDisable the /Upgrade route by setting autoConfigure to false in config.ini, and ensure allow_url_include is set to off in PHP runtime settings.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify VuFind version
    Locate the VuFind version file or check version information in your installation (often in a VERSION, composer.json, or similar file in the VuFind root directory)
    Affected if Installed version is 2.0 or higher but lower than 9.1.1
  2. Confirm /Upgrade route is accessible
    Check if the /Upgrade/FixConfig endpoint is reachable on your VuFind server (attempt a request or check route configuration)
    Affected if The /Upgrade route responds and is not blocked by web server configuration
  3. Check autoConfigure setting in config.ini
    Locate the config.ini file in your VuFind configuration directory and look for the autoConfigure parameter under the [Upgrade] or general settings section
    Affected if autoConfigure is set to true or is not explicitly set to false (defaulting to enabled)
  4. Verify PHP allow_url_include setting
    Check your PHP configuration (php.ini) or runtime settings for the allow_url_include directive
    Affected if allow_url_include is set to On (enabled)
  5. Check for existing config file modifications
    Inspect the VuFind configuration directory for any recently modified or unexpected config files that may have been altered through this vulnerability
    Affected if Unexpected or unauthorized changes exist in configuration files

You are affected if your VuFind installation is version 2.0 through 9.1 (below 9.1.1), the /Upgrade route is accessible, autoConfigure is enabled in config.ini, and allow_url_include is On in PHP settings.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Disable the /Upgrade route by setting autoConfigure to false in config.ini, and ensure allow_url_include is set to off in PHP runtime settings.

Recommended fix High confidence

VuFind 9.1.1

  1. Upgrade VuFind to version 9.1.1 or later by following the official upgrade documentation for your installation method
  2. As a defense-in-depth measure, verify that the PHP runtime setting allow_url_include is set to Off (this is the default and secure setting)
  3. In config.ini, confirm that autoConfigure is set to false to disable the /Upgrade route, which prevents access to /Upgrade/FixConfig even if other misconfigurations exist
  4. After upgrading, restart the web server and clear any caches
Caveat Review the VuFind 9.1.1 release notes for any configuration or feature changes that may affect your installation

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-25738 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-25738 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data