CVE-2024-45229

Executive Summary

CVE-2024-45229 is an authentication bypass vulnerability in Versa Director, a network orchestration and management platform. The flaw resides in a REST API endpoint that, by design, does not require authentication. An unauthenticated attacker can inject invalid arguments into a GET request to this endpoint, potentially exposing authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183, leading to unauthorized access and control. The vulnerability is only exploitable on Versa Directors directly connected to the Internet. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has not released a specific patch version but recommends upgrading to remediated software versions and using WAF/API Gateway rules as a workaround.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary software component of Versa Networks. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Exposure of authentication tokens, not credentials.
• Integrity Impact: Low (I:L) – Tokens can be used to modify configurations.
• Availability Impact: Low (A:L) – Potential for service disruption via API abuse.
• Threat Level: Medium – Exploitation requires the Director to be Internet-facing, but no authentication is needed. The impact is limited to token theft and subsequent API abuse.

Deep Dive & Mechanics

The vulnerability exists in the Versa Director’s REST API, specifically in endpoints that are intentionally left unauthenticated for operational purposes (e.g., login screen, banner display, device registration). The affected endpoint is /vnms/devicereg/device/* on ports 9182 and 9183, and /versa/vnms/devicereg/device/* on port 443.

Root Cause: The API endpoint does not properly validate input arguments. By injecting invalid or malformed arguments into a GET request, an attacker can trigger an error condition that leaks authentication tokens (e.g., session cookies or bearer tokens) of other currently logged-in users. This is a classic example of CWE-306 (Missing Authentication for Critical Function) combined with improper input validation.

Attack Flow:

1. The attacker sends a crafted GET request to the vulnerable endpoint with invalid arguments (e.g., ?invalidParam=malicious).
2. The server processes the request and, due to a bug, returns the authentication tokens of active sessions in the response (e.g., in error messages, headers, or response body).
3. The attacker extracts these tokens and uses them to authenticate to other APIs on port 9183, gaining unauthorized access to the Director’s management functions.

Why It Works: The endpoint is designed to be public, but the error handling logic inadvertently exposes sensitive data. The vulnerability does not disclose usernames or passwords, only session tokens, which are time-limited but still dangerous.

Vulnerable vs. Patched Code

No specific code diff is available as the vendor has not released a public patch. However, based on the description, the vulnerable code likely resembles:

# Vulnerable pseudo-code
@app.route('/vnms/devicereg/device/<device_id>', methods=['GET'])
def device_registration(device_id):
    # No authentication check
    args = request.args
    if 'invalidParam' in args:
        # Error handling that leaks tokens
        return jsonify({'error': 'Invalid parameter', 'tokens': get_active_tokens()}), 400
    # Normal processing
    return jsonify({'status': 'ok'})

The patched version would:

• Remove token exposure from error responses.
• Add authentication checks to the endpoint.
• Validate and sanitize all input arguments.

# Patched pseudo-code
@app.route('/vnms/devicereg/device/<device_id>', methods=['GET'])
@requires_auth  # Added authentication
def device_registration(device_id):
    args = request.args
    if 'invalidParam' in args:
        # Safe error handling
        return jsonify({'error': 'Invalid parameter'}), 400
    # Normal processing
    return jsonify({'status': 'ok'})

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Versa Director instance exposed to the Internet (or a lab environment with port 9182/9183 accessible).
• No authentication required for the initial request.

Exploitation Steps:

1. Identify the target Versa Director (e.g., via Shodan dork port:9183 "Versa").
2. Send a crafted GET request to the vulnerable endpoint:

   curl -v "http://<target>:9182/vnms/devicereg/device/test?invalidParam=1"
   

3. Examine the response for authentication tokens (e.g., Set-Cookie, Authorization header, or JSON body).
4. Extract a valid token and use it to access other APIs:

   curl -v "http://<target>:9183/vnms/devicereg/device/list" -H "Cookie: <token>"
   

5. Perform further actions (e.g., modify device configurations, extract network data).

Note: No public exploit code is available. The above is a conceptual simulation.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual GET requests to /vnms/devicereg/device/* with unexpected parameters.
• Alert on responses containing tokens in error messages or headers.
• Use WAF rules to block requests with invalid arguments to these endpoints.

Hunting:

• Search logs for requests to the vulnerable endpoints with parameters like invalidParam, test, or other non-standard keys.
• Correlate with subsequent authenticated API calls on port 9183 from the same source IP.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual GET requests to /vnms/devicereg/device/* or /versa/vnms/devicereg/device/* with malformed arguments.
  • Responses containing session tokens (e.g., JSESSIONID, X-Auth-Token) in error messages.
  • Subsequent API calls on port 9183 from IPs that previously sent unauthenticated requests.
• Host IOCs:
  • Unexpected entries in Versa Director logs indicating token leakage.
  • Unauthorized configuration changes made via API.
• File IOCs:
  • No specific file hashes available.

Detection Engineering

YARA Rule

rule Detect_Versa_Token_Leakage {
    meta:
        description = "Detects responses from Versa Director that may contain leaked authentication tokens"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45229"
    strings:
        $token_pattern = /(JSESSIONID|X-Auth-Token|Authorization):\s*[A-Za-z0-9\-_]+/
        $error_pattern = /"error":\s*"Invalid parameter"/
        $vuln_path = /\/vnms\/devicereg\/device\//
    condition:
        $vuln_path and $error_pattern and $token_pattern
}

Sigma Rule

title: Versa Director Token Leakage via Unauthenticated API
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-45229 by injecting invalid arguments into the device registration API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: versa_director
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/vnms/devicereg/device/*'
            - '/versa/vnms/devicereg/device/*'
        cs-uri-query|contains: 'invalidParam'
    condition: selection
falsepositives:
    - Legitimate testing or debugging
level: high

Suricata Rule

alert http any any -> any 9182,9183,443 (msg:"CVE-2024-45229 - Versa Director Token Leakage Attempt"; flow:to_server; content:"GET"; http_method; content:"/vnms/devicereg/device/"; http_uri; content:"invalidParam"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Contact Versa support to obtain and apply the remediated software version. No specific version number is available, but the vendor has confirmed patches exist.
2. WAF/API Gateway: Block access to the vulnerable URLs:
   • /vnms/devicereg/device/* on ports 9182 and 9183
   • /versa/vnms/devicereg/device/* on port 443
3. Network Segmentation: Ensure Versa Directors are not directly exposed to the Internet. Place them behind a firewall or VPN.

Long-Term Fixes:

• Implement proper authentication for all API endpoints, even those intended for public use.
• Sanitize and validate all input parameters to prevent injection attacks.
• Conduct regular security audits and penetration testing.

Workarounds:

• If upgrading is not immediately possible, use WAF rules to inspect and block requests with suspicious parameters to the vulnerable endpoints.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert