CVE-2024-34323

Executive Summary

CVE-2024-34323 is an Insecure Direct Object Reference (IDOR) vulnerability in ProPhoenix Law RMS version 2022.2403.3.101, exposed through the usrLogin$hdnPFID parameter. A remote, unauthenticated attacker can craft an HTTP request that references an object belonging to another user, resulting in unauthorized access to sensitive information. Law enforcement and public-safety agencies running the affected Records Management System face exposure of case, personnel, or login-related data, and no patch currently exists.

Technical Analysis

ProPhoenix Law RMS is a Records Management System (RMS) used by law enforcement and public-safety organizations to store incident reports, case files, and related records. The vulnerability is a classic Insecure Direct Object Reference (IDOR), cataloged under CWE-639 (Authorization Bypass Through User-Controlled Key). The NVD description states that the flaw is reachable "via the usrLogin$hdnPFID parameter" and that a "crafted HTTP request" allows "attackers to access sensitive information."

The parameter name usrLogin$hdnPFID indicates an ASP.NET-style server control identifier (the $ delimiter and hdn prefix are typical of WebForms hidden-field naming conventions), meaning the value is submitted as part of a login or user-context request and is trusted by the server without an accompanying authorization check tying the referenced object to the authenticated (or unauthenticated) requester. Because the requested object — presumably a "PFID" (a person/party/primary file identifier within the product's naming) — is selected by a client-supplied value rather than by server-side session ownership checks, an attacker can enumerate or substitute identifiers to reference records they should not be able to reach.

The precise object type, database mapping, and response format are not specified in the NVD description, so those details cannot be asserted here. What is verifiable: (1) the flaw is an IDOR / authorization-bypass-through-user-controlled-key, (2) it is triggered through a crafted HTTP request carrying the usrLogin$hdnPFID parameter, and (3) the confidentiality impact is the exposure of sensitive information. There is no evidence of an authentication-bypass-to-code-execution chain, no patch, no CVE-assigned CVSS from NVD, and no public proof-of-concept or exploit code.

The absence of a CVSS score from NVD and the absence of CWE assignment from the CNA mean downstream scoring must be inferred. Based on the class (network-reachable IDOR with no stated authentication requirement and high confidentiality impact), a reasonable first-party vector would be CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but this is an inference, not an official NVD score.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the single parameter named in the NVD description.

1. Reconnaissance / target identification. Because Law RMS instances are typically deployed by public-safety agencies, an attacker identifies internet- or partner-network-reachable Law RMS deployments. Fingerprinting relies on product-specific page titles, the WebForms control naming pattern, and the presence of a login or user-context endpoint that references usrLogin$hdnPFID. Shodan-style searches on product banners and page content can enumerate candidate hosts.

2. Triggering the flaw (IDOR class). The attacker sends a crafted HTTP request to a Law RMS endpoint, supplying a manipulated value for the usrLogin$hdnPFID parameter. Because the server uses the client-supplied identifier to look up the referenced object without verifying that the requester is authorized for that object, the request resolves to a record the attacker does not own or should not see. No exploitation primitive beyond a legitimate HTTP request carrying a modified parameter value is required at the vulnerability-class level.

3. Payload / execution method. At the class level, exploitation consists of substituting or enumerating identifier values in the usrLogin$hdnPFID parameter (e.g., incrementing or iterating identifiers) and observing the corresponding responses. The NVD description does not disclose the exact encoding, expected value format, or response representation, so no specific payload string is asserted here.

4. Post-exploitation impact. Successful enumeration yields unauthorized access to sensitive information stored within the RMS. Given the victim profile (law enforcement / public-safety records management), exposed data may include personally identifiable information, case or incident details, or account-related data. The description establishes confidentiality impact; there is no stated integrity or availability impact and no stated path to further compromise.

Impact Assessment

The impact concentrates on confidentiality. Records Management Systems in the public-safety sector hold regulated, sensitive, and often legally protected data; unauthorized disclosure can trigger privacy, criminal-justice-information, and contractual notification obligations. Blast radius is potentially broad: any Law RMS deployment exposing the vulnerable parameter is reachable by any actor with network access to that endpoint, and because IDORs are enumeration-friendly, a single vulnerable host can yield many records per successful probe. A single mis-scoped record disclosure is typically serialized to bulk extraction as attackers iterate identifiers.

CVSS reference (inferred, not NVD-supplied): an unauthenticated network vector with low attack complexity, no privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity/availability impact yields roughly 7.5 (High). This is an analytic estimate derived from the vulnerability class and stated impact — it is not an official NVD score and should be treated as provisional. EPSS has not yet scored this CVE, and CISA KEV does not list it; there is no evidence of in-the-wild exploitation.

Detection Guidance

Detection focuses on anomalous access to the usrLogin$hdnPFID parameter — particularly requests that carry this parameter from unauthenticated or low-privilege contexts, and sequences indicative of identifier enumeration (rapid iteration of the same parameter with changing values).

Sigma Rule

title: ProPhoenix Law RMS IDOR via usrLogin$hdnPFID Parameter
id: 8f7c1d2e-3b4a-4c5d-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests referencing the ProPhoenix Law RMS usrLogin$hdnPFID parameter, indicative of IDOR exploitation attempts (CVE-2024-34323).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-34323
author: valtersit.com
date: 2024-05-06
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
      - 'usrLogin$hdnPFID'
    cs-method: 'GET'
  selection_post:
    cs-uri-query|contains|all:
      - 'usrLogin'
    cs-method: 'POST'
  condition: selection_param or selection_post
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate application traffic referencing the same control
level: medium

YARA Rule

rule CVE_2024_34323_ProPhoenix_IDOR
{
    meta:
        description = "Detects references to the ProPhoenix Law RMS usrLogin$hdnPFID parameter associated with CVE-2024-34323"
        author = "valtersit.com"
        date = "2024-05-06"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34323"
        severity = "medium"

    strings:
        $p1 = "usrLogin$hdnPFID" ascii wide nocase
        $p2 = "usrLogin%24hdnPFID" ascii wide nocase
        $a1 = "ProPhoenix" ascii wide nocase
        $a2 = "Law RMS" ascii wide nocase

    condition:
        filesize < 2MB and
        (any of ($p1, $p2)) and
        (any of ($a1, $a2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-34323 ProPhoenix Law RMS IDOR - usrLogin$hdnPFID Parameter Access"; flow:established,to_server; http.uri; content:"usrLogin"; nocase; http.uri; content:"hdnPFID"; nocase; classtype:attempted-recon; reference:cve,2024-34323; reference:url,nvd.nist.gov/vuln/detail/CVE-2024-34323; sid:3432301; rev:1;)

Enhancement for enumeration: pair the above with a threshold / detection_filter clause to alert on repeated requests to the same URI path with varying usrLogin$hdnPFID values. Note: the exact URI path and encoding are not disclosed in the advisory; the rule matches on parameter-name content, which is the only verbatim artifact available.

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where http.request.method == "POST" and
    process.name : ("w3wp.exe", "nginx", "httpd") and
    url.query contains "usrLogin"]
  [network where http.request.method == "POST" and
    url.query contains "hdnPFID"]

For deployments where EQL is applied to web-access logs rather than packet metadata, translate to: a single web event stream matching on url.query containing usrLogin$hdnPFID, grouped by source.ip, alerting on bursts (>20 in 5 minutes) consistent with identifier enumeration.

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| eval param=urldecode(uri_query)
| where like(param, "%usrLogin$hdnPFID%") OR (like(param,"%usrLogin%") AND like(param,"%hdnPFID%"))
| stats count values(status) as http_codes dc(param) as distinct_requests by clientip, uri_path
| where count >= 10
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="343230" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>usrLogin</match>
    <regex>hdnPFID</regex>
    <description>CVE-2024-34323: Possible ProPhoenix Law RMS IDOR access to usrLogin$hdnPFID</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2024_34323,idor,</group>
  </rule>
  <rule id="343231" level="12" frequency="20" timeframe="120">
    <if_matched_sid>343230</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2024-34323: Repeated usrLogin$hdnPFID access - suspected IDOR enumeration</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is published by the CNA/NVD as of this report.

1) Immediate mitigations

• Restrict network exposure: place Law RMS instances behind VPN, zero-trust access brokers, or IP allow-lists; do not expose the login/context endpoint to the public internet.
• Apply server-side authorization: ensure every object referenced by usrLogin$hdnPFID is validated against the authenticated requester's ownership/role before the object is returned. This is the definitive fix at the application layer and may require vendor involvement.
• Add reverse-proxy/WAF virtual patching to block or rate-limit requests using usrLogin$hdnPFID from unauthenticated or unexpected sources, and to throttle high-frequency enumeration of the parameter.
• Enable verbose web-access logging (IIS/access_combined) forwarding to the SIEM so IDOR probes are auditable.

2) Patch / upgrade steps

• No patch exists. Open a support case with ProPhoenix referencing CVE-2024-34323 and request a fixed build. Until a fixed version is issued, treat the instance as vulnerable regardless of configuration.
• Monitor the NVD entry and any ProPhoenix advisory channel for an updated version number; when released, test in a staging environment and upgrade.

3) Long-term hardening

• Adopt object-level authorization controls (e.g., enforce that session identity, not client input, determines object access) across the RMS; treat usrLogin$hdnPFID and any similar client-supplied identifiers as untrusted.
• Deploy continuous access-log analytics to baseline normal identifier access and alert on enumeration patterns (see Detection Guidance).
• Include IDOR and authorization-bypass test cases in acquisition/acceptance testing and periodic third-party security assessments for any public-safety RMS.
• Establish an SBOM/vulnerability-tracking process tied to this product line so law-enforcement customers receive timely recall/patch notices.

References

• NVD — CVE-2024-34323: https://nvd.nist.gov/vuln/detail/CVE-2024-34323
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP — Insecure Direct Object Reference (IDOR) guidance: https://owasp.org/www-project-top-ten/
• CISA KEV Catalog (CVE-2024-34323 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation evidence: No public proof-of-concept, no Nuclei template, no exploit code, and no documented threat-actor campaign are associated with this CVE in the provided intelligence. EPSS has not yet scored it and CISA KEV does not list it. Any operational use of the attack chain above should be treated as inferred from the IDOR vulnerability class until vendor or research confirmation becomes available.