CVE-2024-26477

Executive Summary

CVE-2024-26477 is an information disclosure vulnerability in Statping-ng v.0.91.0. An attacker can send a crafted request to the api parameter of the oauth, amazon_sns, or export endpoints to obtain sensitive information, such as configuration details, secrets, or internal system data. This vulnerability has a CVSS score of 0.0 (unscored) and no known patch. The EPSS score is 0.0%, indicating low exploitation likelihood, but the lack of a patch makes it a persistent risk for any exposed instance.

Supply Chain & Package Security

Statping-ng is a Go-based application. The vulnerability affects the application's API handling logic, not a specific package dependency. However, the lack of a patch means that any deployment using the vulnerable version is at risk. Organizations should audit their use of Statping-ng and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium (due to lack of patch and potential for sensitive data exposure)

Deep Dive & Mechanics

The vulnerability lies in the API endpoint handling of Statping-ng. The oauth, amazon_sns, and export endpoints accept a api parameter that is not properly sanitized. An attacker can inject a crafted request to this parameter to trigger the disclosure of sensitive information, such as environment variables, database credentials, or internal configuration files.

The root cause is insufficient input validation and lack of access control on these endpoints. The application does not verify that the requesting user is authorized to access the data exposed via the api parameter.

Vulnerable vs. Patched Code

Vulnerable Code (v.0.91.0):

// Example of vulnerable endpoint handler
func handleExport(w http.ResponseWriter, r *http.Request) {
    apiParam := r.URL.Query().Get("api")
    if apiParam != "" {
        // Directly uses apiParam without validation
        data := getSensitiveData(apiParam)
        w.Write(data)
    }
}

Patched Code (Hypothetical):

// Example of patched endpoint handler
func handleExport(w http.ResponseWriter, r *http.Request) {
    apiParam := r.URL.Query().Get("api")
    if apiParam != "" {
        // Validate that the user is authorized
        if !isAuthorized(r) {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        // Sanitize the apiParam to prevent injection
        sanitizedParam := sanitizeInput(apiParam)
        data := getSensitiveData(sanitizedParam)
        w.Write(data)
    }
}

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a Statping-ng instance (e.g., via Shodan or manual scanning).
2. Send a crafted GET request to the vulnerable endpoint:

   curl "http://target:8080/api/oauth?api=../../etc/passwd"
   

3. Observe the response for sensitive data.

Proof of Concept:

# Exploit for CVE-2024-26477
curl -v "http://target:8080/api/export?api=config"

Blue Team

Detection Steps:

1. Monitor logs for unusual API requests to /api/oauth, /api/amazon_sns, or /api/export with a non-empty api parameter.
2. Look for requests containing path traversal patterns (e.g., ../, %2e%2e/).
3. Alert on any successful response containing sensitive data (e.g., passwords, tokens).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/oauth?api=*, /api/amazon_sns?api=*, /api/export?api=*
  • Requests with path traversal sequences in the api parameter
• File IOCs:
  • Unauthorized access to /etc/passwd, /proc/self/environ, or application config files
• Log IOCs:
  • Log entries showing api parameter with suspicious values

Detection Engineering

YARA Rule

rule CVE_2024_26477_Statping_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2024-26477 in Statping-ng"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-26477"
    strings:
        $s1 = "/api/oauth?api="
        $s2 = "/api/amazon_sns?api="
        $s3 = "/api/export?api="
        $s4 = "../"
        $s5 = "%2e%2e/"
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2024-26477 Statping-ng Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-26477
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/api/oauth?api='
            - '/api/amazon_sns?api='
            - '/api/export?api='
    condition: selection
falsepositives:
    - Legitimate API usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-26477 Statping-ng Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/api/"; http_uri; content:"?api="; http_uri; pcre:"/(oauth|amazon_sns|export)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict access to the vulnerable endpoints (/api/oauth, /api/amazon_sns, /api/export) via a web application firewall (WAF) or reverse proxy.
2. Implement network segmentation to limit exposure of Statping-ng instances.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply a patch from the vendor if available. If not, consider migrating to a maintained alternative.
• Implement proper input validation and access control on all API endpoints.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests with suspicious api parameters:

  location ~ ^/api/(oauth|amazon_sns|export) {
      if ($arg_api ~ "\.\.") {
          return 403;
      }
  }
  

Valters IT
Cyber Threat Intelligence & DevSecOps