CVE-2024-12553

Executive Summary

CVE-2024-12553 is a critical Missing Authorization vulnerability in GeoVision GV-ASManager, specifically within the GV-ASWeb service. This flaw allows an authenticated attacker (including those using default guest credentials) to access sensitive functionality without proper authorization checks. The primary impact is the disclosure of stored credentials, which can lead to lateral movement and further compromise of the physical access control system. With a CVSS score of 6.5 (Medium), the vulnerability is notable for its low attack complexity and the potential for credential harvesting. No public exploit code or proof-of-concept has been released, but the risk is elevated due to the lack of a vendor patch.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects a proprietary on-premise physical access control system (PACS) from GeoVision. The risk is primarily to end-user organizations that deploy GV-ASManager in their security infrastructure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires authentication, but default guest credentials are acceptable.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - The vulnerable component remains the same.
• Confidentiality (C): High (H) - Stored credentials are disclosed.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The requirement for authentication lowers the severity, but the availability of default credentials and the high value of disclosed credentials (which can unlock other systems) makes this a priority for patching or mitigation.

Deep Dive & Mechanics

The vulnerability resides in the GV-ASWeb service, a web-based interface for the GV-ASManager access control system. The core issue is a failure to enforce proper authorization checks on specific API endpoints or web pages. When an authenticated user (even with guest privileges) sends a crafted HTTP request to a sensitive endpoint, the server processes the request without verifying if the user has the necessary permissions.

The specific flaw (ZDI-CAN-25394) likely involves an endpoint that returns configuration data, including stored credentials for other systems (e.g., database connections, email servers, or other integrated services). The lack of authorization means that any authenticated user can enumerate these credentials.

Attack Flow:

1. Reconnaissance: An attacker identifies a GV-ASManager instance (e.g., via Shodan dorks).
2. Authentication: The attacker logs in using default guest credentials (e.g., guest/guest or admin/admin).
3. Exploitation: The attacker sends a GET or POST request to a vulnerable endpoint (e.g., /api/getCredentials or /config/export).
4. Data Exfiltration: The server returns sensitive data, including plaintext or weakly hashed credentials.
5. Lateral Movement: The attacker uses the harvested credentials to access other systems (e.g., the underlying Windows server, database, or network devices).

Vulnerable vs. Patched Code

No official patch is available. The following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual - C#/ASP.NET):

[HttpGet]
public IActionResult GetCredentials()
{
    // Missing authorization attribute
    var creds = _dbContext.Credentials.ToList();
    return Ok(creds);
}

Patched Code (Conceptual):

[HttpGet]
[Authorize(Roles = "Administrator")] // Added authorization check
public IActionResult GetCredentials()
{
    var creds = _dbContext.Credentials.ToList();
    return Ok(creds);
}

The patched version adds an [Authorize] attribute to restrict access to users with the "Administrator" role, preventing guest users from accessing the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A lab environment with GeoVision GV-ASManager (any version).
• Network access to the GV-ASWeb service (default port 80/443).
• Default guest credentials (e.g., guest/guest).

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find GV-ASManager instances.

   nmap -p 80,443 --script http-title <target_ip>
   

2. Authenticate: Log in using default credentials.

   curl -X POST -d "username=guest&password=guest" http://<target_ip>/login
   

3. Enumerate Endpoints: Use a web fuzzer to discover sensitive endpoints.

   ffuf -u http://<target_ip>/FUZZ -w /usr/share/wordlists/raft-large-directories.txt -c -fc 403,404
   

4. Exploit Missing Authorization: Access the vulnerable endpoint.

   curl -b "session=<session_cookie>" http://<target_ip>/api/GetAllCredentials
   

   Expected output: JSON or XML containing usernames and passwords.

No Exploit-DB code is available for this CVE.

Blue Team

Detection & Response:

1. Monitor Authentication Logs: Look for successful logins using default or guest accounts, especially from unexpected IPs.
2. Web Server Logs: Identify requests to unusual API endpoints (e.g., /api/GetAllCredentials, /config/export).
3. Network Traffic: Detect large outbound data transfers from the GV-ASManager server.
4. Honeypot: Deploy a fake credential endpoint to trap attackers.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/GetAllCredentials or similar endpoints.
  • Outbound connections from GV-ASManager to unknown IPs on ports 80/443.
• Host:
  • Unusual processes running under the GV-ASManager service account.
  • New scheduled tasks or services.
• Logs:
  • Successful logins with guest or admin accounts.
  • Access to configuration files outside of normal administrative hours.

Detection Engineering

YARA Rule

rule CVE_2024_12553_GV_ASManager_Credential_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-12553 by searching for requests to credential disclosure endpoints"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12553"
    strings:
        $s1 = "/api/GetAllCredentials" ascii wide nocase
        $s2 = "/config/export" ascii wide nocase
        $s3 = "GV-ASWeb" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-12553 - GeoVision GV-ASManager Credential Disclosure Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting potential credential disclosure endpoints in GV-ASManager
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - '/api/GetAllCredentials'
            - '/config/export'
            - '/api/credentials'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12553 GeoVision GV-ASManager Credential Disclosure Attempt"; flow:to_server; content:"/api/GetAllCredentials"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Immediately change all default passwords for guest and admin accounts.
2. Network Segmentation: Place GV-ASManager on a separate VLAN with strict firewall rules. Do not expose it directly to the internet.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests to suspicious API endpoints (e.g., /api/GetAllCredentials).

Long-Term Fix:

• Vendor Patch: Monitor GeoVision's official website for a security patch. If none is released, consider replacing the system with a supported alternative.
• Code Review: If source code is available, implement proper authorization checks on all sensitive endpoints.

Valters IT