CVE-2024-45870

Executive Summary

CVE-2024-45870 is a critical vulnerability in Bandisoft BandiView version 7.05, involving an Incorrect Access Control flaw in the sub_0x3d80fc function. The vulnerability is triggered via a crafted Proof of Concept (POC) file, allowing an attacker to bypass intended access restrictions. This could lead to unauthorized actions, such as reading sensitive files or executing arbitrary code, depending on the context. The vulnerability has a public Proof of Concept (POC) but no known patch or exploit code at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for targeted attacks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the nature of the vulnerability (Incorrect Access Control), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires a crafted file to be opened.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – user must open the file.
• Scope (S): Unchanged (U) – vulnerability affects the same component.
• Confidentiality (C): High (H) – potential to read arbitrary files.
• Integrity (I): High (H) – potential to modify files.
• Availability (A): High (H) – potential to crash the application.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit with a crafted file, and the impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability resides in the sub_0x3d80fc function of BandiView 7.05. This function is responsible for handling access control checks when processing image files. Due to an incorrect access control implementation, the function fails to properly validate permissions or boundaries when parsing a specially crafted POC file. This allows an attacker to bypass security checks and perform unauthorized operations, such as reading arbitrary memory or files from the system.

The flaw is likely a result of missing or insufficient permission checks before performing sensitive operations. For example, the function may attempt to read or write to a file path without verifying that the user has the right to do so, or it may allow access to system resources that should be restricted.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, based on the vulnerability description, the patched version would likely include additional validation checks in the sub_0x3d80fc function to ensure that access control is enforced before any sensitive operation.

Vulnerable Code (Hypothetical):

void sub_0x3d80fc(char *file_path) {
    // Missing access control check
    FILE *file = fopen(file_path, "rb");
    if (file) {
        // Process file
    }
}

Patched Code (Hypothetical):

void sub_0x3d80fc(char *file_path) {
    // Added access control check
    if (!is_allowed_path(file_path)) {
        return;
    }
    FILE *file = fopen(file_path, "rb");
    if (file) {
        // Process file
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• BandiView 7.05 installed on a target system.
• Ability to deliver a crafted POC file (e.g., via email, download, or USB).

Exploitation Steps:

1. Create a malicious POC file that triggers the vulnerability in sub_0x3d80fc.
2. Deliver the file to the target user.
3. When the user opens the file with BandiView, the exploit executes, bypassing access controls.
4. The attacker can then read sensitive files (e.g., C:\Windows\System32\config\SAM) or execute arbitrary code.

Example POC File Structure (Hypothetical):

# Python script to generate a malicious POC file
import struct

# Craft a file that triggers the vulnerability
payload = b"\x00" * 100  # Placeholder for actual exploit data
with open("exploit.poc", "wb") as f:
    f.write(payload)

Blue Team

Detection:

• Monitor for unusual file access patterns by BandiView.exe.
• Use process monitoring tools to detect when BandiView attempts to access sensitive files (e.g., C:\Windows\System32).
• Enable file integrity monitoring for critical system files.

Mitigation:

• Restrict execution of BandiView to trusted users only.
• Use application whitelisting to prevent unauthorized software.
• Implement strict file access controls (e.g., using Windows DACLs).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – actual hash depends on the exploit file)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: BandiView.exe
• File Paths: Any .poc file opened by BandiView.
• Network Connections: None expected (local exploit).
• Registry Keys: None expected.

Detection Engineering

YARA Rule

rule CVE_2024_45870_BandiView_Exploit {
    meta:
        description = "Detects crafted POC files targeting CVE-2024-45870 in BandiView"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45870"
    strings:
        $magic = { 00 00 00 00 }  // Placeholder for exploit magic bytes
        $trigger = { 3D 80 FC }   // Placeholder for function signature
    condition:
        $magic at 0 and $trigger
}

Sigma Rule

title: CVE-2024-45870 BandiView Incorrect Access Control
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-45870 via crafted POC files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\BandiView.exe'
        CommandLine|contains: '.poc'
    condition: selection
falsepositives:
    - Legitimate use of .poc files
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-45870 BandiView Exploit Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall BandiView 7.05 until a patch is available.
2. Restrict file execution using application control policies (e.g., Windows AppLocker).
3. Educate users not to open untrusted .poc files.

Long-term Fix:

• Monitor Bandisoft’s official channels for a patched version.
• Apply the patch as soon as it is released.
• Implement a file reputation service to block known malicious files.

Workaround:

• Use a different image viewer until the vulnerability is fixed.

Valters IT