CVE-2024-45058

Executive Summary

CVE-2024-45058 is a critical privilege escalation vulnerability in i-Educar, a free, fully online school management software. The flaw resides in the /intranet/educar_usuario_cad.php endpoint, where an attacker with minimal viewing privileges can craft a POST request to modify the nivel_usuario_ parameter, elevating their user type to Administrator or any other super-permission role. The vulnerability stems from a missing authorization check (CWE-862) in the user editing functionality. With a CVSS score of 8.1, this vulnerability poses a high risk to confidentiality, integrity, and availability. A patch is available in commit c25910cdf11ab50e50162a49dd44bef544422b6e, but the status of official releases is unknown.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the i-Educar PHP application. Organizations using i-Educar should verify their deployment version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The attacker can exploit the vulnerability remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs only minimal viewing privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full access to sensitive data.
• Integrity Impact: High (I:H) – Ability to modify data and settings.
• Availability Impact: High (A:H) – Potential to disrupt services.

Threat Level: Critical. The low barrier to entry (low privileges, no user interaction) combined with the high impact makes this a prime target for attackers.

Deep Dive & Mechanics

The vulnerability is located in the file ieducar/intranet/educar_usuario_cad.php. This script handles user profile updates, including the user type (role). The critical flaw is that the script does not verify whether the currently logged-in user has the necessary permissions to change the user type of another user (or their own). Specifically, the nivel_usuario_ parameter is accepted and processed without checking if the requester is an administrator.

Attack Flow:

1. An attacker obtains minimal viewing privileges (e.g., a teacher or secretary account).
2. The attacker crafts a POST request to /intranet/educar_usuario_cad.php with the target user ID and the desired nivel_usuario_ value (e.g., 1 for Administrator).
3. The server processes the request and updates the user's role without any authorization check.
4. The attacker now has administrative privileges and can perform any action in the system.

The vulnerability is a classic example of Missing Authorization (CWE-862). The patch adds a permission check, likely verifying that the current user has the admin or equivalent role before allowing changes to user types.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// ieducar/intranet/educar_usuario_cad.php (vulnerable)
<?php
// ... no permission check ...
$nivel = $_POST['nivel_usuario_'];
$userId = $_POST['cod_usuario'];
// Directly update the user's level
$sql = "UPDATE usuario SET nivel_usuario = $nivel WHERE cod_usuario = $userId";
// Execute query
?>

Patched Code (simplified):

// ieducar/intranet/educar_usuario_cad.php (patched)
<?php
// Check if current user is admin
if (!$_SESSION['is_admin']) {
    die('Permission denied');
}
$nivel = $_POST['nivel_usuario_'];
$userId = $_POST['cod_usuario'];
// Update the user's level
$sql = "UPDATE usuario SET nivel_usuario = $nivel WHERE cod_usuario = $userId";
// Execute query
?>

The patch adds a session-based permission check before processing the update.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an i-Educar instance with a low-privilege account (e.g., teacher).
• Knowledge of the target user ID (can be obtained from the user list).

Exploit Steps:

1. Log in with the low-privilege account.
2. Capture a legitimate POST request to /intranet/educar_usuario_cad.php (e.g., when editing a user).
3. Modify the request to change the nivel_usuario_ parameter to 1 (Administrator) for your own user ID.
4. Replay the request.

Example cURL command:

curl -X POST https://target-ieducar.com/intranet/educar_usuario_cad.php \
  -H "Cookie: PHPSESSID=your_session_id" \
  -d "cod_usuario=123&nivel_usuario_=1&acao=Alterar"

Expected Outcome: The user with ID 123 is now an administrator.

Blue Team (Detection & Hardening)

Detection:

• Monitor POST requests to /intranet/educar_usuario_cad.php for unusual nivel_usuario_ values.
• Alert on any user type change that is not performed by an administrator.
• Log all user role modifications and correlate with the requesting user's privileges.

Hardening:

• Apply the patch from commit c25910cdf11ab50e50162a49dd44bef544422b6e.
• Implement additional server-side permission checks.
• Use a Web Application Firewall (WAF) to block requests with suspicious nivel_usuario_ parameters.
• Enforce strict session management and role-based access control (RBAC).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /intranet/educar_usuario_cad.php with nivel_usuario_ parameter set to a value other than the original user type.
  • Unusual user agent strings or repeated requests from the same IP.
• System:
  • User accounts with unexpected role changes (e.g., teacher becomes admin).
  • New administrator accounts created after the exploit.
• Logs:
  • Audit logs showing user type modifications without a corresponding admin session.
  • Error logs with permission denied messages (if partial patching is in place).

Detection Engineering

YARA Rule

rule CVE_2024_45058_Privilege_Escalation {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45058 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45058"
    strings:
        $s1 = "educar_usuario_cad.php" nocase
        $s2 = "nivel_usuario_" nocase
        $s3 = "cod_usuario" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45058 - i-Educar Privilege Escalation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to educar_usuario_cad.php with nivel_usuario_ parameter indicating privilege escalation.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/intranet/educar_usuario_cad.php'
        cs-uri-query|contains: 'nivel_usuario_'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45058 - i-Educar Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/intranet/educar_usuario_cad.php";
    http_uri;
    content:"nivel_usuario_";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit c25910cdf11ab50e50162a49dd44bef544422b6e to the ieducar/intranet/educar_usuario_cad.php file.
2. If patching is not possible, restrict access to the vulnerable endpoint using a WAF or reverse proxy.
3. Review all user accounts for unauthorized privilege changes.

Long-term Mitigations:

• Implement a formal RBAC system with strict permission checks on all administrative actions.
• Conduct regular security audits and code reviews.
• Enable detailed logging and monitoring for all user management operations.
• Keep the i-Educar software updated to the latest version.

Workaround:

• Remove or disable the educar_usuario_cad.php file if not needed, or restrict its access to specific IP addresses (e.g., internal admin network).

Valters IT
Securing Digital Frontiers