CVE-2024-42407

Executive Summary

CVE-2024-42407 is a medium-severity information disclosure vulnerability in Gallagher Command Centre, a physical security and access control system. The flaw resides in the Alarm Transmitter feature, where sensitive information is improperly inserted into log files (CWE-532). An authenticated Operator with low privileges can read these logs to access security-sensitive data they are not authorized to view, such as credentials, configuration secrets, or other system internals. This could enable privilege escalation or lateral movement within the Command Centre environment.

The vulnerability affects all versions of Command Centre Server 8.80 and prior, as well as versions 8.90 before MR6, 9.00 before MR5, and 9.10 before MR4. Patches are available from Gallagher. No public exploit code or proof-of-concept has been released, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the sensitive nature of physical security systems, immediate patching is recommended.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary physical security management platform. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated Operator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. While the attack requires authentication, the low complexity and network accessibility make it a realistic threat for insiders or attackers who have compromised low-privilege credentials. The disclosure of sensitive information (e.g., credentials, tokens) could lead to further compromise.

Deep Dive & Mechanics

The vulnerability exists in the Alarm Transmitter feature of Gallagher Command Centre. This feature is responsible for sending alarm notifications to external systems (e.g., email, SMS, or third-party integrations). During normal operation, the system logs events and data for debugging and auditing purposes.

Root Cause: The software logs sensitive information (e.g., authentication tokens, API keys, or internal configuration data) in plaintext within the Command Centre Server log files. This violates the principle of least privilege, as Operators with read access to logs can view data they should not have access to.

Attack Vector:

1. An attacker gains access to a low-privileged Operator account (e.g., via phishing, credential stuffing, or insider threat).
2. The attacker navigates to the log viewing interface or directly accesses log files on the server (if file system access is available).
3. The attacker parses the logs for sensitive strings (e.g., passwords, tokens, or configuration secrets).
4. The attacker uses this information to escalate privileges or access other parts of the system.

Impact: Successful exploitation could allow an attacker to:

• View credentials for other users or services.
• Access configuration secrets for integrations (e.g., email servers, SMS gateways).
• Gain insight into system architecture for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable logging in Alarm Transmitter
def send_alarm(alarm_data, auth_token):
    log.info(f"Sending alarm with data: {alarm_data} and token: {auth_token}")
    # ... send alarm ...

Patched Code (Conceptual):

# Patched version - redact sensitive fields
def send_alarm(alarm_data, auth_token):
    log.info(f"Sending alarm with data: {alarm_data} and token: [REDACTED]")
    # ... send alarm ...

The patch ensures that sensitive information (e.g., tokens, passwords) is either omitted or redacted before being written to logs. Gallagher has released specific MR (Maintenance Release) updates that address this issue.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Gallagher Command Centre environment with a vulnerable version.
• A low-privileged Operator account.

Steps:

1. Authenticate: Log in to the Command Centre web interface or client with the Operator account.
2. Access Logs: Navigate to the log viewing section (e.g., System Logs, Audit Logs, or Alarm Transmitter logs).
3. Search for Sensitive Data: Use search functionality or export logs to look for patterns like:
   • password=
   • token=
   • api_key=
   • secret=
   • Authorization:
4. Extract Credentials: Copy any discovered credentials or tokens.
5. Escalate: Use the extracted credentials to access higher-privileged accounts or external systems.

Example Log Entry (Vulnerable):

2024-08-15 10:23:45 [INFO] Alarm Transmitter: Sending alarm to SMTP server with credentials: user=admin, password=SuperSecret123!

Blue Team

Detection:

• Monitor for unusual access to log files or log viewing interfaces by low-privileged users.
• Alert on searches for sensitive keywords in logs (e.g., password, token, secret).
• Use file integrity monitoring (FIM) to detect unauthorized access to log files.

Hunting:

• Review logs for patterns of credential disclosure.
• Check for repeated log exports by non-admin users.

Mitigation:

• Apply the patch immediately.
• Restrict log access to only necessary personnel.
• Implement log redaction tools (e.g., using regex to mask sensitive data before storage).

Indicators of Compromise (IOCs)

• Log Entries: Presence of plaintext credentials or tokens in Command Centre logs.
• User Activity: Unusual access to log viewing features by low-privileged accounts.
• File Access: Unauthorized reads of log files (e.g., C:\ProgramData\Gallagher\CommandCentre\Logs\* on Windows).
• Network Traffic: Outbound connections from the Command Centre server to external systems using credentials found in logs (if attacker uses them).

Detection Engineering

YARA Rule

rule CVE_2024_42407_Gallagher_Log_Disclosure {
    meta:
        description = "Detects plaintext sensitive data in Gallagher Command Centre logs"
        author = "Valters IT"
        date = "2024-08-15"
        reference = "CVE-2024-42407"
    strings:
        $sensitive1 = /password\s*[:=]\s*\S+/i
        $sensitive2 = /token\s*[:=]\s*\S+/i
        $sensitive3 = /api_key\s*[:=]\s*\S+/i
        $sensitive4 = /secret\s*[:=]\s*\S+/i
        $sensitive5 = /Authorization:\s*\S+/i
    condition:
        any of ($sensitive*)
}

Sigma Rule

title: Gallagher Command Centre Sensitive Data in Logs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-42407 by searching for plaintext credentials in logs
author: Valters IT
date: 2024-08-15
logsource:
    product: gallagher_command_centre
    service: logs
detection:
    selection:
        - EventID: 1000-9999  # Example event IDs for log entries
        - Message|contains:
            - 'password='
            - 'token='
            - 'api_key='
            - 'secret='
            - 'Authorization:'
    condition: selection
falsepositives:
    - Legitimate debugging by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42407 Gallagher Command Centre Sensitive Data Exfiltration"; flow:to_server,established; content:"password="; nocase; content:"token="; nocase; content:"api_key="; nocase; content:"secret="; nocase; content:"Authorization:"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the following patched versions:
   • Command Centre Server 9.10.2149 (MR4) or later
   • Command Centre Server 9.00.2374 (MR5) or later
   • Command Centre Server 8.90.2356 (MR6) or later
   • For 8.80 and prior, upgrade to a supported version.
2. Log Rotation: Implement log rotation and retention policies to limit exposure.
3. Access Control: Restrict log access to only authorized administrators.

Long-Term Measures:

• Implement log redaction/masking for all sensitive fields.
• Conduct regular security audits of log files.
• Use SIEM to monitor for anomalous log access patterns.
• Enforce multi-factor authentication (MFA) for all Operator accounts.

Workaround (if patching is delayed):

• Disable the Alarm Transmitter feature if not in use.
• Manually review and sanitize logs using a script to redact sensitive data.

Valters IT
DevSecOps & Cyber Threat Intelligence