CVE-2023-50811

Executive Summary

CVE-2023-50811 is an insecure direct object reference (IDOR) vulnerability discovered in SELESTA Visual Access Manager (VAM) version 4.38.6. The flaw allows an authenticated attacker to modify the “computer” POST parameter, which corresponds to the ID of a specific reception. By intercepting and iterating this parameter in a POST HTTP request, an attacker can gain unauthorized access to and control over many other receptions beyond their assigned one. This vulnerability enables horizontal privilege escalation, potentially compromising the security of multiple physical access control points managed by the system.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary physical access control system (SELESTA Visual Access Manager). No supply chain or package security implications apply.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Base Score: 8.1 (High)

Breakdown:

• Attack Vector (AV): Network – the attacker can exploit the vulnerability remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – the attacker needs a valid account with at least one reception assignment.
• User Interaction (UI): None – no user interaction is required.
• Scope (S): Unchanged – the vulnerable component and the impacted component are the same.
• Confidentiality (C): High – the attacker can access sensitive data of other receptions.
• Integrity (I): High – the attacker can modify settings or control other receptions.
• Availability (A): None – the vulnerability does not directly impact availability.

Threat Level: High. The vulnerability allows an authenticated attacker to horizontally escalate privileges and take control of multiple physical access points, which could lead to unauthorized physical access to secured areas.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (IDOR), classified under CWE-639. The SELESTA Visual Access Manager application uses a POST parameter named “computer” to identify a specific reception (physical access control point). When an authenticated user interacts with the application, the system does not properly verify that the user is authorized to access the reception identified by the “computer” parameter.

Attack Flow:

1. An attacker authenticates to the SELESTA VAM web interface with a valid account that is assigned to at least one reception.
2. The attacker intercepts a legitimate POST request (e.g., using a proxy like Burp Suite) that contains the “computer” parameter.
3. The attacker modifies the value of the “computer” parameter to iterate through other reception IDs (e.g., 1, 2, 3, ...).
4. The server processes the request without validating that the attacker’s account is authorized for the target reception.
5. The attacker gains unauthorized access to view, modify, or control the settings and operations of other receptions.

Root Cause: The application lacks server-side authorization checks for the “computer” parameter. It relies on client-side or implicit trust, allowing an attacker to manipulate the parameter value.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely performs a database lookup based on the “computer” parameter without verifying the user’s permissions.

# Vulnerable pseudocode
def handle_reception_request(request):
    computer_id = request.POST.get('computer')
    # Directly fetch reception data without authorization check
    reception = Reception.objects.get(id=computer_id)
    return render_reception_data(reception)

Patched Code (Conceptual): The patched code should include an authorization check to ensure the user is assigned to the requested reception.

# Patched pseudocode
def handle_reception_request(request):
    computer_id = request.POST.get('computer')
    # Verify user authorization
    if not request.user.has_permission_for_reception(computer_id):
        return HttpResponseForbidden("Access denied")
    reception = Reception.objects.get(id=computer_id)
    return render_reception_data(reception)

Note: Since no official patch details are available, the above is a best-practice remediation approach.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the SELESTA VAM system.
• Network access to the VAM web interface.
• A web proxy tool (e.g., Burp Suite, OWASP ZAP).

Exploitation Steps:

1. Log in to the SELESTA VAM web interface with your assigned credentials.
2. Navigate to a page that handles reception operations (e.g., reception management).
3. Configure your browser to use a proxy (e.g., Burp Suite) and intercept the POST request.
4. Identify the “computer” parameter in the intercepted request.
5. Send the request to Burp Repeater or Intruder.
6. Modify the “computer” parameter value to a different reception ID (e.g., change from 1 to 2).
7. Send the modified request and observe the response. If successful, you will see data or controls for the other reception.
8. Iterate through reception IDs to map out all accessible receptions.

Example Intercepted Request:

POST /reception/update HTTP/1.1
Host: vam.example.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session_cookie

computer=1&action=view

Modified Request:

POST /reception/update HTTP/1.1
Host: vam.example.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session_cookie

computer=2&action=view

Blue Team (Detection & Defense)

Detection:

• Monitor for anomalous POST requests where the “computer” parameter value changes rapidly or sequentially.
• Alert on requests where a user accesses a reception ID that is not in their assigned list.
• Log all access to reception management endpoints and correlate with user permissions.

Defense:

• Implement server-side authorization checks for all object references.
• Use indirect object references (e.g., random tokens) instead of sequential IDs.
• Apply the principle of least privilege for user accounts.
• Conduct regular security audits and penetration testing.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to endpoints like /reception/update, /reception/view, or similar with varying “computer” parameter values.
  • Sequential or brute-force patterns in the “computer” parameter (e.g., 1, 2, 3, ...).
  • Requests from a single user account accessing multiple reception IDs in a short time.

• Log IOCs:

  • Access logs showing a user accessing reception IDs outside their assigned range.
  • Error logs with “403 Forbidden” responses if authorization checks are partially implemented.

• System IOCs:

  • Unauthorized changes to reception configurations (e.g., door schedules, access permissions).
  • Unexpected user accounts gaining access to restricted areas.

Detection Engineering

YARA Rule

rule Detect_SELESTA_VAM_IDOR_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2023-50811 via POST requests with sequential computer parameter values"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50811"
    strings:
        $post_method = "POST"
        $computer_param = "computer="
        $reception_endpoint = "/reception/"
    condition:
        $post_method and $computer_param and $reception_endpoint and
        # of ($computer_param) > 5
}

Sigma Rule

title: SELESTA VAM IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple POST requests to SELESTA VAM reception endpoints with varying computer parameter values from a single user.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/reception/'
        cs-uri-query|contains: 'computer='
    condition: selection
    timeframe: 5m
    aggregation:
        - field: c-ip
          condition: gt 5
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"SELESTA VAM IDOR Exploit - Multiple Reception Access";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/reception/";
    http_uri;
    content:"computer=";
    http_client_body;
    threshold: type both, track by_src, count 5, seconds 300;
    sid:1000001;
    rev:1;
    reference:cve,2023-50811;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: If possible, restrict network access to the SELESTA VAM interface to trusted IP addresses only.
2. Review user permissions: Ensure that all user accounts have the minimum necessary privileges.
3. Monitor logs: Actively monitor for signs of exploitation as described in the IOCs section.

Long-term Fixes:

1. Apply vendor patch: Contact SELESTA for an official patch. If unavailable, consider implementing a Web Application Firewall (WAF) rule to block requests with manipulated “computer” parameters.
2. Implement authorization checks: Modify the application code to validate that the authenticated user is authorized to access the specified reception ID.
3. Use indirect object references: Replace sequential IDs with random, non-guessable tokens.
4. Conduct security audit: Perform a thorough security review of the application to identify similar vulnerabilities.

Workaround:

• If patching is not possible, implement a reverse proxy or WAF rule to restrict the “computer” parameter to a whitelist of allowed values per user.

Valters IT
Securing Digital Frontiers