CVE-2024-32166

Executive Summary

CVE-2024-32166 is an Insecure Direct Object Reference (IDOR) vulnerability in Webid v1.2.1, a web-based auction management platform. The flaw allows an authenticated attacker to bypass access controls and purchase items from auctions that have been suspended by the administrator. This constitutes a horizontal privilege escalation, as the attacker can act on a suspended auction that should not be available for bidding or purchasing. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a standalone web application. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (attacker can complete a purchase on a suspended auction)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows a direct impact on the integrity of auction transactions.

Deep Dive & Mechanics

The vulnerability resides in the auction purchase functionality of Webid v1.2.1. When an administrator suspends an auction, the application should prevent any further bidding or purchasing. However, due to a lack of server-side access control checks, the application relies on client-side or insufficient server-side validation of the auction status.

Root Cause: The application does not verify the status field of the auction object before processing a purchase request. An attacker can send a direct HTTP request to the purchase endpoint (e.g., /api/auction/buy) with the auction_id parameter of a suspended auction. The server processes the request without checking if the auction is active, allowing the purchase to complete.

Attack Flow:

1. Attacker authenticates as a regular user.
2. Attacker identifies a suspended auction (e.g., via ID enumeration or by observing the auction list).
3. Attacker sends a POST request to the purchase endpoint with the suspended auction's ID.
4. The server processes the request and completes the purchase, updating the database.

Horizontal Privilege Escalation: The attacker gains the ability to perform an action (buying) that should be restricted for all users on a suspended auction. This is horizontal because the attacker does not gain admin privileges but can bypass a state-based restriction.

Vulnerable vs. Patched Code

Vulnerable Code (Server-side PHP example):

// Vulnerable: No status check
function buyAuction($auctionId, $userId) {
    $auction = getAuctionById($auctionId);
    // Missing: if ($auction['status'] != 'active') { die('Auction suspended'); }
    $price = $auction['current_price'];
    processPayment($userId, $price);
    updateAuctionStatus($auctionId, 'sold');
}

Patched Code (Hypothetical fix):

// Patched: Status check added
function buyAuction($auctionId, $userId) {
    $auction = getAuctionById($auctionId);
    if ($auction['status'] != 'active') {
        die('Auction is not active');
    }
    $price = $auction['current_price'];
    processPayment($userId, $price);
    updateAuctionStatus($auctionId, 'sold');
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Webid v1.2.1.
• Valid user credentials (e.g., user:password).
• Knowledge of a suspended auction ID (e.g., 42).

Exploit Steps:

1. Log in to the application and obtain a session cookie.
2. Identify a suspended auction. This can be done by browsing the auction list and noting IDs that are marked as "suspended" in the UI, or by brute-forcing IDs.
3. Send a crafted HTTP request to purchase the suspended auction.

Example cURL command:

curl -X POST https://target.com/api/auction/buy \
  -H "Cookie: session=valid_session_cookie" \
  -H "Content-Type: application/json" \
  -d '{"auction_id": 42}'

Expected Response: The server returns a success message (e.g., {"status":"success","message":"Purchase completed"}), and the auction is marked as sold.

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /api/auction/buy with unusual auction IDs (e.g., IDs that are not in the active auction list).
• Alert on successful purchases of auctions that were previously marked as suspended.
• Log all auction status changes and correlate with purchase events.

Hardening:

• Implement server-side validation of auction status before processing any purchase.
• Use a whitelist of allowed auction IDs for the current user session.
• Add rate limiting on the purchase endpoint.
• Conduct regular code reviews focusing on access control logic.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/auction/buy with JSON body containing auction_id of a suspended auction.
  • Unusual HTTP 200 responses for purchase requests on suspended auctions.
• Log IOCs:
  • Server logs showing auction_id values that are not in the active auction list.
  • Database entries where status changes from suspended to sold without an admin action.
• File IOCs:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_32166_Webid_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-32166 in Webid v1.2.1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32166"
    strings:
        $s1 = "/api/auction/buy" ascii wide nocase
        $s2 = "auction_id" ascii wide nocase
        $s3 = "suspended" ascii wide nocase
    condition:
        all of ($s1, $s2) or ($s1 and $s3)
}

Sigma Rule

title: CVE-2024-32166 Webid IDOR Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP POST requests to the Webid auction buy endpoint with potential IDOR exploitation.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/auction/buy
        cs-uri-query: '*auction_id*'
    condition: selection
falsepositives:
    - Legitimate purchase requests for active auctions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32166 Webid IDOR Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/api/auction/buy"; http_uri; content:"auction_id"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the purchase endpoint for suspended auctions via a web application firewall (WAF) rule.
2. Manually patch the code by adding a server-side status check in the purchase function (see patched code above).
3. Audit all auction transactions to identify any unauthorized purchases that may have already occurred.

Long-term Fixes:

• Upgrade to a patched version if the vendor releases one.
• Implement a robust access control framework (e.g., using a policy engine like OPA).
• Conduct regular penetration testing focusing on IDOR vulnerabilities.
• Apply the principle of least privilege to all API endpoints.

Workaround:

• If patching is not possible, restrict access to the purchase endpoint to only trusted IPs or require additional authentication factors.

Valters IT
DevSecOps & Cyber Threat Intelligence