CVE-2024-10598

Executive Summary

CVE-2024-10598 is a critical improper authorization vulnerability in Tongda OA versions 11.2 through 11.6. The flaw resides in the /general/hr/setting/attendance/leave/data.php file, specifically within the Annual Leave Handler component. An unauthenticated, remote attacker can exploit this vulnerability to bypass authorization checks, potentially leading to unauthorized access to sensitive data, modification of leave records, or further compromise of the OA system. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary PHP-based web application (Tongda OA). The risk is primarily to organizations that have deployed this on-premise OA system.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated Critical (9.8) based on vector.
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Data can be modified.
• Availability (A): High (H) – Potential for denial of service or system compromise.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a high-priority threat for any organization using the affected Tongda OA versions.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the Annual Leave Handler. The file general/hr/setting/attendance/leave/data.php likely fails to properly verify the user's session or permissions before processing requests. An attacker can send crafted HTTP requests to this endpoint to perform actions such as:

• Viewing, creating, modifying, or deleting leave records for any user.
• Escalating privileges by manipulating user roles or permissions if the handler interacts with user management functions.
• Accessing other sensitive data within the OA system if the handler has broader database access.

The lack of proper authorization checks means that any unauthenticated request to this endpoint is processed as if it were from a legitimate administrator.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

<?php
// vulnerable/data.php
// No session check or authorization
$action = $_GET['action'];
$user_id = $_GET['user_id'];
// Process action without verifying permissions
if ($action == 'view') {
    $result = query("SELECT * FROM leave_records WHERE user_id = $user_id");
    echo json_encode($result);
}
?>

Patched Code (Expected):

<?php
// patched/data.php
session_start();
if (!isset($_SESSION['user_id']) || !$_SESSION['is_admin']) {
    header('HTTP/1.0 403 Forbidden');
    exit('Access denied');
}
$action = $_GET['action'];
$user_id = intval($_GET['user_id']); // Input sanitization
// Verify user has permission to access this user's data
if ($_SESSION['user_id'] != $user_id && !$_SESSION['is_admin']) {
    header('HTTP/1.0 403 Forbidden');
    exit('Access denied');
}
// Process action
if ($action == 'view') {
    $stmt = $pdo->prepare("SELECT * FROM leave_records WHERE user_id = ?");
    $stmt->execute([$user_id]);
    $result = $stmt->fetchAll();
    echo json_encode($result);
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Tongda OA 11.2-11.6.
• Network access to the OA web interface.

Exploit Steps:

1. Identify the target endpoint: http://target-oa/general/hr/setting/attendance/leave/data.php
2. Craft a request to exploit the authorization bypass. For example, to view all leave records:

   GET /general/hr/setting/attendance/leave/data.php?action=view&user_id=1 HTTP/1.1
   Host: target-oa
   

3. To modify a record:

   POST /general/hr/setting/attendance/leave/data.php HTTP/1.1
   Host: target-oa
   Content-Type: application/x-www-form-urlencoded
   
   action=update&leave_id=123&status=approved
   

4. Use a tool like curl:

   curl -v "http://target-oa/general/hr/setting/attendance/leave/data.php?action=view&user_id=1"
   

Note: The exact parameters and actions may vary. Fuzzing the endpoint is recommended.

Blue Team (Defensive)

Detection:

• Monitor for unusual requests to /general/hr/setting/attendance/leave/data.php from unauthenticated sources.
• Look for patterns of mass enumeration (e.g., sequential user_id values).
• Alert on any POST requests to this endpoint without a valid session cookie.

Hunting:

• Search web server logs for requests to data.php with parameters like action, user_id, leave_id.
• Correlate with authentication logs to identify requests that bypassed login.

Lab Setup:

• Deploy a vulnerable instance of Tongda OA 11.6 in an isolated environment.
• Use a web application firewall (WAF) to test detection rules.
• Simulate exploitation using the steps above and verify alerts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /general/hr/setting/attendance/leave/data.php without a valid session cookie.
  • Unusual parameters in requests to this endpoint (e.g., action=admin, user_id=0).
• File System:
  • Modified or new leave records in the database.
  • Unexpected entries in web server access logs for the vulnerable path.
• System:
  • Unauthorized changes to user permissions or roles.
  • Suspicious outbound connections from the OA server.

Detection Engineering

YARA Rule

rule tongda_oa_cve_2024_10598 {
    meta:
        description = "Detects exploitation attempts for CVE-2024-10598 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10598"
    strings:
        $s1 = "/general/hr/setting/attendance/leave/data.php" nocase
        $s2 = "action=" nocase
        $s3 = "user_id=" nocase
    condition:
        all of them
}

Sigma Rule

title: Tongda OA CVE-2024-10598 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint in Tongda OA
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/general/hr/setting/attendance/leave/data.php'
        cs-method: 'GET' or 'POST'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Tongda OA CVE-2024-10598 Exploitation Attempt"; flow:to_server; content:"/general/hr/setting/attendance/leave/data.php"; http_uri; content:"action="; http_uri; content:"user_id="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the OA system from the internet if possible.
2. Apply virtual patching using a WAF to block requests to /general/hr/setting/attendance/leave/data.php from unauthenticated sources.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no official patch is available, consider:
  • Disabling the vulnerable component by removing or renaming the data.php file (if business impact is acceptable).
  • Implementing custom authentication checks in the file (requires code access).
  • Upgrading to a patched version when released by Tongda.
  • Migrating to an alternative OA solution if the vendor does not provide a fix.

Workaround:

• Restrict access to the vulnerable path via .htaccess or web server configuration:

  <Location "/general/hr/setting/attendance/leave/data.php">
      Require ip 192.168.1.0/24
  </Location>
  

Valters IT
Securing Digital Ecosystems