CVE-2024-45408

Executive Summary

CVE-2024-45408 is an incorrect permission check vulnerability in eLabFTW, an open-source electronic lab notebook for research labs. An authenticated user can access restricted information due to flawed authorization logic. If anonymous access is enabled (disabled by default), this extends to unauthenticated users. The vulnerability has a CVSS score of 7.5 (High) and affects versions prior to 5.1.0. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

eLabFTW is a PHP-based application distributed via GitHub and Docker. The vulnerability is in the application's permission handling logic, not in a third-party package. Users should verify the integrity of their eLabFTW installation and ensure they are running version 5.1.0 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows an attacker with low privileges to access sensitive information, such as experimental data, team resources, or system configuration details. The threat is primarily to data confidentiality.

Deep Dive & Mechanics

The vulnerability stems from an incorrect permission check in eLabFTW's authorization middleware. When a user requests a resource (e.g., an experiment, team, or admin panel), the application fails to properly validate whether the user has the required role or team membership. This allows an authenticated user to access resources belonging to other teams or users.

The flaw is in the checkPermissions() function or similar authorization logic, which may use a flawed comparison or fail to check team membership. For example, a user in Team A could access experiments in Team B by manipulating the request parameters (e.g., team_id or experiment_id). If anonymous access is enabled, unauthenticated users can also exploit this by sending crafted requests without authentication.

The vulnerability does not require any special privileges beyond being logged in (or anonymous access being enabled). It is a classic case of insecure direct object reference (IDOR) combined with improper authorization.

Vulnerable vs. Patched Code

The vulnerable code likely resides in a controller or middleware that checks permissions. A simplified example:

Vulnerable Code (PHP):

// Vulnerable: Only checks if user is authenticated, not team membership
function checkPermissions($user, $resource) {
    if ($user->isAuthenticated()) {
        return true; // Incorrectly grants access
    }
    return false;
}

Patched Code (PHP):

// Patched: Verifies user has access to the specific resource's team
function checkPermissions($user, $resource) {
    if ($user->isAuthenticated() && $user->getTeamId() === $resource->getTeamId()) {
        return true;
    }
    return false;
}

The patch ensures that the user's team ID matches the resource's team ID before granting access. Additionally, anonymous access is now properly restricted by default.

Exploitation & Lab Setup

Red Team

Prerequisites:

• eLabFTW instance running version < 5.1.0
• Valid user credentials (or anonymous access enabled)
• Network access to the eLabFTW web interface

Exploitation Steps:

1. Log in to eLabFTW as a regular user (e.g., user1 in Team A).
2. Identify a target resource, such as an experiment in Team B. The URL might be https://elabftw.example.com/experiments.php?mode=view&id=123.
3. Modify the request to access a resource from another team. For example, change the id parameter to an experiment ID belonging to Team B.
4. If the permission check is flawed, the application will return the experiment data, including title, description, and attached files.
5. For anonymous access, simply send the request without authentication headers.

Example HTTP Request:

GET /experiments.php?mode=view&id=456 HTTP/1.1
Host: elabftw.example.com
Cookie: PHPSESSID=valid_session_id

Expected Outcome: The attacker gains access to sensitive research data from other teams.

Blue Team

Detection:

• Monitor for unusual access patterns, such as a single user accessing experiments from multiple teams.
• Look for HTTP requests with manipulated id or team_id parameters that do not match the user's team.
• Enable logging of all permission check failures and review for anomalies.

Hunting:

• Query web server logs for requests to experiments.php, database.php, or admin.php with parameters that suggest IDOR attempts.
• Use the following Splunk query to detect potential exploitation:

index=web_logs sourcetype=access_combined
| search uri=*/experiments.php* OR uri=*/database.php*
| rex field=uri "id=(?<resource_id>\d+)"
| stats count by src_ip, user, resource_id
| where count > 10

Mitigation:

• Immediately upgrade to eLabFTW version 5.1.0 or later.
• Disable anonymous access in the System configuration panel.
• Implement additional monitoring for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /experiments.php, /database.php, or /admin.php with manipulated id or team_id parameters.
  • Repeated 403 or 401 responses followed by successful 200 responses for the same resource.
• Host IOCs:
  • Unusual entries in eLabFTW access logs showing access to resources outside the user's team.
  • Modified session tokens or cookies indicating anonymous access attempts.
• File IOCs:
  • Log files containing patterns like "mode=view&id=" with sequential or out-of-range IDs.

Detection Engineering

YARA Rule

rule Detect_eLabFTW_Permission_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-45408 in eLabFTW logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45408"
    strings:
        $s1 = "experiments.php?mode=view&id="
        $s2 = "database.php?mode=view&id="
        $s3 = "admin.php?mode=view&id="
        $s4 = "team_id="
    condition:
        any of ($s*) and #s4 > 1
}

Sigma Rule

title: eLabFTW Permission Bypass Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2024-45408 in eLabFTW
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "experiments.php?mode=view&id="
            - "database.php?mode=view&id="
            - "admin.php?mode=view&id="
    condition: selection
falsepositives:
    - Legitimate access by team members
level: medium

Suricata Rule

alert http any any -> any any (msg:"eLabFTW Permission Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"experiments.php"; http_uri; content:"mode=view"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to eLabFTW version 5.1.0 or later. This is the only complete fix.
2. Workaround: Disable anonymous access in the System configuration panel if not required.
3. Configuration Review: Ensure that all user roles and team memberships are correctly configured.
4. Monitoring: Enable detailed logging and monitor for unauthorized access attempts.
5. Network Segmentation: Restrict access to eLabFTW to trusted networks only.
6. User Education: Inform users about the importance of strong passwords and reporting suspicious activity.

Valters IT
Securing Your Digital Frontier