CVE-2024-10965

Executive Summary

CVE-2024-10965 is a problematic information disclosure vulnerability affecting EMQX Neuron up to version 2.10.0. The flaw resides in the /api/v2/schema endpoint, which is part of the JSON File Handler component. An attacker can remotely exploit this vulnerability to gain unauthorized access to sensitive information. The vendor has released a patch (commit c9ce39747e0372aaa2157b2b56174914a12c06d8) to address the issue. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates that a full CVSS vector has not been assigned by NVD. However, based on the description (remote attack, information disclosure), a reasonable assessment would be:

• Attack Vector (AV): Network (N) – the attack can be launched remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerability does not affect other components.
• Confidentiality (C): High (H) – sensitive information is disclosed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High (due to remote, unauthenticated access to sensitive data).

Deep Dive & Mechanics

The vulnerability is located in the /api/v2/schema endpoint of the EMQX Neuron application. This endpoint is part of the JSON File Handler, which is responsible for processing and serving schema definitions. The exact mechanism of the information disclosure is not publicly detailed, but it likely involves improper access controls or insufficient validation of user input, allowing an attacker to retrieve schema files or other sensitive configuration data that should not be exposed.

EMQX Neuron is an industrial IoT connectivity server used for data collection and device management. Exposing schema information could reveal details about the data structures, device configurations, and potentially credentials or other secrets embedded in the schema files.

Vulnerable vs. Patched Code

The patch commit c9ce39747e0372aaa2157b2b56174914a12c06d8 addresses the vulnerability. Without access to the exact code changes, we can infer that the patch likely:

• Adds authentication or authorization checks to the /api/v2/schema endpoint.
• Restricts the types of files that can be accessed via the endpoint.
• Implements input validation to prevent path traversal or other attacks.

Vulnerable Code (Conceptual):

@app.route('/api/v2/schema')
def get_schema():
    schema_name = request.args.get('name')
    # No authentication check
    # No validation of schema_name
    return open(f'/schemas/{schema_name}').read()

Patched Code (Conceptual):

@app.route('/api/v2/schema')
@require_authentication
def get_schema():
    schema_name = request.args.get('name')
    if not is_valid_schema_name(schema_name):
        abort(400)
    # Only allow specific schema files
    allowed_schemas = ['device.json', 'network.json']
    if schema_name not in allowed_schemas:
        abort(403)
    return open(f'/schemas/{schema_name}').read()

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy EMQX Neuron version 2.10.0 in a Docker container.
2. Ensure the /api/v2/schema endpoint is accessible without authentication.

Exploitation Steps:

1. Identify the target Neuron instance (e.g., http://target:7000).
2. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target:7000/api/v2/schema?name=../../etc/passwd"
   

3. If the endpoint is vulnerable, it will return the contents of the requested file.
4. Attempt to access common schema files or configuration files:

   curl -X GET "http://target:7000/api/v2/schema?name=neuron.conf"
   curl -X GET "http://target:7000/api/v2/schema?name=../conf/neuron.conf"
   

Expected Outcome: The attacker can read arbitrary files from the server, leading to information disclosure.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual GET requests to /api/v2/schema with suspicious query parameters (e.g., name=../, name=/etc/).
• Look for requests that attempt path traversal or access non-schema files.
• Alert on multiple failed attempts to access the endpoint.

Response:

1. Immediately apply the patch (commit c9ce39747e0372aaa2157b2b56174914a12c06d8).
2. If patching is not possible, restrict access to the /api/v2/schema endpoint using a web application firewall (WAF) or reverse proxy.
3. Review server logs for any signs of exploitation.
4. Rotate any credentials or secrets that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/v2/schema with parameters like name=../, name=/etc/, or other path traversal patterns.
  • Unusual outbound data transfers from the Neuron server.
• File System IOCs:
  • Unexpected access to files outside the schema directory (e.g., /etc/passwd, configuration files).
• Log IOCs:
  • Log entries showing GET /api/v2/schema with suspicious query strings.
  • Error messages related to file not found or permission denied for the schema endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_10965_Neuron_InfoDisclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-10965 in EMQX Neuron"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10965"
    strings:
        $suspicious_path = "/api/v2/schema"
        $path_traversal = "../"
        $etc_passwd = "/etc/passwd"
    condition:
        $suspicious_path and ($path_traversal or $etc_passwd)
}

Sigma Rule

title: CVE-2024-10965 - EMQX Neuron Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable /api/v2/schema endpoint with path traversal attempts.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10965
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "/api/v2/schema"
            - "../"
            - "/etc/"
    condition: selection
falsepositives:
    - Legitimate schema requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10965 - EMQX Neuron Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/v2/schema"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply the patch from commit c9ce39747e0372aaa2157b2b56174914a12c06d8 to all affected versions (<= 2.10.0).
2. Workaround: If patching is not immediately possible, restrict access to the /api/v2/schema endpoint using a reverse proxy or WAF. Only allow trusted IP addresses to access this endpoint.
3. Configuration Review: Ensure that the Neuron server is not exposed to the internet unnecessarily. Use network segmentation to limit access.
4. Monitoring: Implement the detection rules provided above to monitor for exploitation attempts.
5. Credential Rotation: If any sensitive data may have been exposed, rotate all credentials and secrets.

Valters IT