LyLme_spage - SSRF (CVE-2024-36675)

CVE-2024-36675 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in LyLme_spage v1.9.5, specifically within the get_head function. This flaw allows remote, unauthenticated attackers to make arbitrary requests from the server, potentially leading to unauthorized access to internal resources or sensitive data exposure.

CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2024-36675 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-36675 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the SSRF vulnerability by sending requests to /apply/index.php with a crafted url parameter, causing the server to make requests to attacker-controlled or internal resources.