CVE-2024-45438

Executive Summary

CVE-2024-45438 is a critical authentication bypass vulnerability in TitanHQ SpamTitan Email Security Gateway versions 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The flaw resides in the quarantine.php endpoint, which allows unauthenticated attackers to trigger account-level actions via crafted GET requests. Specifically, providing a non-existent email address in the email parameter causes SpamTitan to automatically create a user record and associate quarantine settings with it—without any authentication. This enables an attacker to create arbitrary user accounts, potentially leading to unauthorized access to quarantine management, email manipulation, and further compromise of the email security gateway. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the lack of authentication and potential for account creation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application issue in the SpamTitan Email Security Gateway.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual severity is medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Threat Level: Medium – Unauthenticated account creation can lead to unauthorized access to quarantine features and potential email data exposure.

Deep Dive & Mechanics

The vulnerability exists in the quarantine.php script, which handles quarantine-related operations for email users. The endpoint accepts an email parameter via GET requests. When a non-existent email address is provided, the script fails to validate the user's authentication status and instead creates a new user record in the database with default quarantine settings. This allows an attacker to:

1. Create arbitrary user accounts without any credentials.
2. Associate quarantine settings with the newly created account, potentially enabling access to quarantine management interfaces.
3. Exploit further by chaining with other vulnerabilities (e.g., privilege escalation) if the created account has elevated permissions.

The root cause is a missing authentication check in the account creation logic. The code likely checks if the email exists but does not verify that the request is from an authenticated session. This is a classic CWE-306 (Missing Authentication for Critical Function) vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (8.00.x < 8.00.101, 8.01.x < 8.01.14):

// quarantine.php (simplified)
$email = $_GET['email'];
if (!user_exists($email)) {
    create_user($email); // No authentication check
    set_quarantine_settings($email, $default_settings);
}

Patched Code (8.00.101, 8.01.14):

// quarantine.php (simplified)
$email = $_GET['email'];
if (!is_authenticated()) {
    die("Authentication required");
}
if (!user_exists($email)) {
    create_user($email);
    set_quarantine_settings($email, $default_settings);
}

The patch adds an authentication check (is_authenticated()) before allowing any account creation or modification.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a vulnerable SpamTitan instance (8.00.x < 8.00.101 or 8.01.x < 8.01.14).
• No authentication required.

Exploit Steps:

1. Send a crafted GET request to the quarantine.php endpoint with a non-existent email address.
2. The server will create a new user account and associate quarantine settings.
3. Use the created account to access quarantine management features.

Example Exploit (using curl):

curl -v "http://target/spamtitan/quarantine.php?email=attacker@example.com"

Expected Response:

• HTTP 200 OK with a success message or redirect.
• The user attacker@example.com is now created.

Post-Exploitation:

• Access quarantine management with the new account.
• Attempt to escalate privileges or access other sensitive data.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual GET requests to quarantine.php with non-existent email addresses.
• Look for spikes in user creation events.
• Check logs for unauthenticated access to quarantine endpoints.

Defense:

• Apply the vendor patch immediately (upgrade to 8.00.101 or 8.01.14).
• Implement web application firewall (WAF) rules to block unauthenticated requests to quarantine.php.
• Restrict access to the SpamTitan interface via network segmentation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /spamtitan/quarantine.php?email=<non-existent-email>
  • Unusual user creation events in SpamTitan logs.
• File IOCs:
  • Log entries showing account creation without prior authentication.
• System IOCs:
  • New user accounts in the SpamTitan database with no associated email activity.

Detection Engineering

YARA Rule

rule CVE_2024_45438_SpamTitan_Quarantine_Account_Creation {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45438 via quarantine.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45438"
    strings:
        $s1 = "quarantine.php" ascii wide nocase
        $s2 = "email=" ascii wide nocase
        $s3 = "create_user" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45438 SpamTitan Quarantine Account Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated account creation via quarantine.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/spamtitan/quarantine.php'
        cs-uri-query|contains: 'email='
    condition: selection
falsepositives:
    - Legitimate user creation by admins (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45438 SpamTitan Quarantine Account Creation"; flow:to_server; content:"GET"; http_method; content:"/spamtitan/quarantine.php"; http_uri; content:"email="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to SpamTitan 8.00.101 or 8.01.14 immediately.
2. Restrict network access to the SpamTitan web interface to trusted IPs only.
3. Implement WAF rules to block unauthenticated GET requests to quarantine.php.

Long-Term Measures:

• Conduct a security audit of all SpamTitan endpoints for similar authentication bypass issues.
• Enable logging and monitoring for all user creation events.
• Apply the principle of least privilege to all user accounts.

Workarounds (if patching is delayed):

• Disable the quarantine.php endpoint temporarily via web server configuration.
• Use a reverse proxy to enforce authentication before requests reach SpamTitan.

Valters IT
DevSecOps & Cyber Threat Intelligence