CVE-2024-39341

Executive Summary

CVE-2024-39341 exposes a critical information disclosure vulnerability in Entrust Instant Financial Issuance (On Premise) Software (formerly Cardwizard). During installation, a configuration file (WebAPI.cfg.xml) is left behind on the IIS web server. This file is accessible without authentication on HTTP port 80 by guessing the correct IIS webroot path. The file contains system configuration parameter names and values, with sensitive configuration values encrypted. An attacker who can access this file can extract encrypted configuration data, potentially leading to further compromise of the system.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely. The encrypted values, while not immediately usable, can be targeted for offline decryption attacks or used to understand the system's architecture for further exploitation.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary software installation issue. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the vulnerability description, a more accurate assessment would be:

• Attack Vector (AV): Network (N) - The file is accessible over HTTP.
• Attack Complexity (AC): Low (L) - Guessing the IIS webroot path is a simple brute-force or enumeration task.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Sensitive configuration data is exposed.
• Integrity (I): None (N) - The file is read-only.
• Availability (A): None (N) - The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The ease of exploitation and the potential for lateral movement or credential compromise make this a serious threat.

Deep Dive & Mechanics

The vulnerability stems from a poor installation practice. The Entrust Instant Financial Issuance software installer places a configuration file (WebAPI.cfg.xml) in the IIS webroot directory. This file is not protected by any authentication mechanism and is accessible via HTTP GET requests.

Root Cause: The installer does not remove or secure the configuration file after installation. The file remains in the webroot, making it publicly accessible.

Attack Vector: An attacker can enumerate common IIS webroot paths (e.g., C:\inetpub\wwwroot\, C:\Program Files\Entrust\, etc.) or use directory brute-forcing tools to locate the file. Once found, a simple HTTP GET request retrieves the file.

Impact: The file contains system configuration parameters, including database connection strings, API keys, and other sensitive data. While the values are encrypted, the encryption algorithm and key may be weak or discoverable. Even if the encryption is strong, the attacker gains valuable information about the system's architecture, which can be used for further attacks (e.g., SQL injection, API abuse).

Encryption Analysis: The description states "sensitive configuration values encrypted." The encryption method is not specified. Common weak encryption methods (e.g., XOR, base64, or simple substitution) could be reversed. Even if strong encryption (e.g., AES) is used, the key might be stored elsewhere in the application or be derivable from the file itself.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable state is the presence of the WebAPI.cfg.xml file in the IIS webroot. There is no code to remove or protect this file after installation.

<!-- WebAPI.cfg.xml (Vulnerable) -->
<configuration>
  <appSettings>
    <add key="DatabaseConnectionString" value="EncryptedValueHere" />
    <add key="APIKey" value="EncryptedValueHere" />
    <add key="ServiceEndpoint" value="https://internal.entrust.local/api" />
  </appSettings>
</configuration>

Patched Code (Conceptual): A patch would involve one or more of the following:

1. Removing the file after installation.
2. Moving the file outside the webroot.
3. Adding authentication (e.g., IIS authentication, IP restrictions) to the file.
4. Encrypting the entire file with a strong, non-derivable key.

<!-- Patched: File moved outside webroot or removed -->
<!-- No file accessible at the webroot path -->

Exploitation & Lab Setup

Red Team

Objective: Retrieve the WebAPI.cfg.xml file and extract encrypted configuration data.

Lab Setup:

• Target: A Windows Server running IIS with Entrust Instant Financial Issuance 6.10.0 installed.
• Attacker: Kali Linux or any system with curl/wget.

Steps:

1. Enumerate IIS Webroot Paths: Common paths include:

   • C:\inetpub\wwwroot\
   • C:\Program Files\Entrust\
   • C:\Program Files (x86)\Entrust\
   • C:\Entrust\

   Use a tool like gobuster or dirb to brute-force directories.

   gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x xml
   

2. Retrieve the Configuration File: Once the path is found, download the file.

   curl http://target.com/WebAPI.cfg.xml -o WebAPI.cfg.xml
   

3. Analyze the File: Open the file and look for encrypted values.

   cat WebAPI.cfg.xml
   

4. Attempt Decryption: If the encryption is weak (e.g., base64, XOR), attempt to reverse it. For example, if it's base64:

   echo "EncryptedValueHere" | base64 -d
   

   If it's XOR, write a simple script to brute-force the key.

   # Example XOR brute-force (conceptual)
   encrypted = "EncryptedValueHere"
   for key in range(256):
       decrypted = ''.join(chr(ord(c) ^ key) for c in encrypted)
       if 'password' in decrypted.lower():
           print(f"Key: {key}, Decrypted: {decrypted}")
   

Blue Team

Objective: Detect and prevent exploitation of this vulnerability.

Detection:

• Monitor HTTP access logs for requests to WebAPI.cfg.xml.
• Alert on any successful retrieval of this file.
• Use file integrity monitoring (FIM) to detect changes to the webroot.

Prevention:

• Immediately remove the WebAPI.cfg.xml file from the webroot.
• Move the file to a secure location outside the webroot.
• Implement IIS authentication or IP restrictions on the file.
• Apply the vendor's patch when available.

Hunting:

• Search for the file across all IIS servers.
• Check for any unauthorized access to the file in logs.

Indicators of Compromise (IOCs)

• File: WebAPI.cfg.xml located in the IIS webroot.
• Network: HTTP GET requests to */WebAPI.cfg.xml.
• Logs: IIS log entries with GET /WebAPI.cfg.xml and a 200 status code.
• Hash (Example): SHA256 of a sample file (if available). (Note: Hash will vary by installation.)

Detection Engineering

YARA Rule

rule CVE_2024_39341_Entrust_Config_Leak {
    meta:
        description = "Detects the presence of the vulnerable WebAPI.cfg.xml file from Entrust Instant Financial Issuance"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-39341"
        severity = "high"
    strings:
        $xml_header = "<?xml version=\"1.0\" encoding=\"utf-8\"?>"
        $config_root = "<configuration>"
        $app_settings = "<appSettings>"
        $entrust_key = "Entrust" nocase
        $cardwizard_key = "Cardwizard" nocase
    condition:
        all of ($xml_header, $config_root, $app_settings) and
        (any of ($entrust_key, $cardwizard_key))
}

Sigma Rule

title: CVE-2024-39341 - Entrust Configuration File Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP GET requests to the vulnerable WebAPI.cfg.xml file
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '*/WebAPI.cfg.xml'
    condition: selection
falsepositives:
    - Legitimate administrative access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39341 - Entrust Configuration File Access"; flow:to_server,established; content:"GET"; http_method; content:"WebAPI.cfg.xml"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the File: Delete WebAPI.cfg.xml from the IIS webroot immediately.
2. Move Configuration: Store configuration files outside the webroot (e.g., C:\ProgramData\Entrust\).
3. Restrict Access: If the file must remain, implement IIS authentication (e.g., Windows Authentication) or IP address restrictions.
4. Apply Patch: Contact Entrust for an official patch. Monitor their security advisories.

Long-Term Measures:

• Implement a secure installation process that does not leave sensitive files in the webroot.
• Use file integrity monitoring (FIM) to detect unauthorized file access.
• Conduct regular security audits of IIS configurations.
• Educate developers on secure deployment practices.

Workaround:

• If patching is not possible, use IIS URL Rewrite to block access to the file:

<rule name="Block WebAPI.cfg.xml" stopProcessing="true">
  <match url="^WebAPI\.cfg\.xml$" />
  <action type="AbortRequest" />
</rule>

Valters IT