CVE-2024-45919

Executive Summary

A privilege escalation vulnerability has been identified in Solvait version 24.4.2. By manipulating the Request ID and Action Type parameters in the /AssignToMe/SetAction endpoint, an unauthenticated attacker can bypass approval workflows. This allows unauthorized access to sensitive information or the approval of fraudulent requests, compromising the integrity and confidentiality of the system.

CVSS Breakdown & Threat Level

While a CVSS score is not officially assigned, based on the description, the vulnerability likely has a high impact on confidentiality and integrity. The attack vector is network-based, requires low complexity, and no privileges, but may require user interaction. A plausible vector would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Deep Dive & Mechanics

The vulnerability resides in the /AssignToMe/SetAction endpoint of Solvait 24.4.2. This endpoint is designed to handle assignment actions within approval workflows. The flaw allows an attacker to manipulate the Request ID and Action Type parameters. By crafting a malicious request, an attacker can:

• Bypass approval workflows.
• Assign themselves or others to sensitive requests.
• Approve fraudulent requests without proper authorization.
• Access sensitive information tied to the request.

The root cause is a lack of proper authorization checks on the server side, allowing parameter tampering to escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Solvait 24.4.2): The vulnerable endpoint likely lacks server-side validation of the user's role or permissions before processing the action. Example pseudo-code:

[HttpPost]
public ActionResult SetAction(int requestId, string actionType)
{
    // No authorization check
    var request = db.Requests.Find(requestId);
    request.Status = actionType;
    db.SaveChanges();
    return Ok();
}

Patched Code (Hypothetical): A patched version would include authorization checks:

[HttpPost]
[Authorize(Roles = "Admin, Approver")]
public ActionResult SetAction(int requestId, string actionType)
{
    var user = GetCurrentUser();
    if (!user.CanApprove(requestId))
        return Unauthorized();
    var request = db.Requests.Find(requestId);
    request.Status = actionType;
    db.SaveChanges();
    return Ok();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Solvait 24.4.2 instance.
• Knowledge of a valid Request ID.

Exploit Steps:

1. Identify a target request ID (e.g., via enumeration or observation).
2. Send a crafted HTTP POST request to /AssignToMe/SetAction with manipulated parameters.

Example cURL command:

curl -X POST https://target.com/AssignToMe/SetAction \
  -d "requestId=123&actionType=Approve" \
  -H "Content-Type: application/x-www-form-urlencoded"

Expected Outcome: The attacker can approve the request without proper authorization.

Blue Team

Detection:

• Monitor for unusual POST requests to /AssignToMe/SetAction with unexpected actionType values.
• Alert on multiple rapid requests from a single IP to different requestId values.
• Log and review all actions performed via this endpoint.

Hunting:

• Search logs for SetAction requests where the user role does not match the action performed.
• Correlate with user authentication logs to detect unauthorized privilege escalation.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /AssignToMe/SetAction with manipulated parameters.
• Logs: Unauthorized approval actions in application logs.
• System: Unexpected changes to request statuses without corresponding authorization.

Detection Engineering

YARA Rule

rule solvait_privilege_escalation {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45919 in Solvait"
        author = "Valters IT"
        date = "2024-10-27"
    strings:
        $s1 = "/AssignToMe/SetAction" ascii wide nocase
        $s2 = "requestId=" ascii wide nocase
        $s3 = "actionType=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Solvait Privilege Escalation via SetAction
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-45919
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/AssignToMe/SetAction'
        cs-uri-query|contains: 
            - 'requestId='
            - 'actionType='
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"Solvait Privilege Escalation Attempt"; flow:to_server; content:"POST"; http_method; content:"/AssignToMe/SetAction"; http_uri; content:"requestId="; http_uri; content:"actionType="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Restrict access to the /AssignToMe/SetAction endpoint to trusted IPs or VPN.
• Implement strong authentication and authorization checks on the server side.
• Monitor logs for suspicious activity.

Long-term Fix:

• Apply vendor patch when available.
• Conduct a security audit of all endpoints handling workflow actions.
• Implement input validation and parameter tampering protection.

Workarounds:

• Disable the endpoint if not essential.
• Use a Web Application Firewall (WAF) to block malicious requests.

Valters IT
Securing Your Digital Frontier