CVE-2024-47063

Executive Summary

CVE-2024-47063 is a Cross-Site Request Forgery (CSRF) vulnerability in the Computer Vision Annotation Tool (CVAT), an open-source interactive video and image annotation platform. The flaw allows a malicious authenticated user with task creation or editing permissions to craft a malicious URL. When a victim user (who is logged into CVAT) visits this URL, the attacker can execute arbitrary API calls on the victim's behalf. This grants the attacker temporary access to all data the victim can access, including projects, tasks, and annotations. The vulnerability is rated with a CVSS score of 0.0 in the NVD data, but based on the impact and attack vector, a more realistic score is 8.8 (High). The patch is available in CVAT version 2.19.0.

Supply Chain & Package Security

CVAT is a Python-based application distributed via Docker images and PyPI packages. The vulnerability is not a supply chain attack but a web application security flaw. However, organizations using CVAT should verify the integrity of their deployment and ensure they are using the official, patched version from the CVAT GitHub repository or Docker Hub. No malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is initiated over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated to the victim's session, but they need a valid CVAT account with task permissions.
• User Interaction (UI): Required (R) - The victim must click on the malicious URL.
• Scope (S): Unchanged (U) - The attacker cannot change the scope of the vulnerability.
• Confidentiality (C): High (H) - Full access to victim's data.
• Integrity (I): High (H) - Ability to modify data via API calls.
• Availability (A): High (H) - Potential to delete or corrupt data.

CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability requires user interaction but can lead to complete data compromise for the victim user.

Deep Dive & Mechanics

The vulnerability is a classic CSRF (Cross-Site Request Forgery) flaw. CVAT uses session cookies for authentication but does not implement CSRF tokens or other anti-CSRF mechanisms on API endpoints. An attacker with a valid CVAT account can create a task or edit an existing task. They can then craft a URL that, when visited by another logged-in user, triggers an API request (e.g., DELETE, PUT, POST) to a CVAT endpoint. Since the victim's browser automatically includes their session cookie, the request is authenticated and executed.

The attack flow:

1. Attacker logs into CVAT and creates a task with a malicious payload (e.g., a link to an external site).
2. Attacker sends the crafted URL to the victim (e.g., via email, chat).
3. Victim, logged into CVAT, clicks the URL.
4. The victim's browser sends a request to the CVAT API with the victim's session cookie.
5. The server processes the request, thinking it's from the victim.
6. Attacker gains access to the victim's data or performs actions on their behalf.

The vulnerability affects all API endpoints that do not have CSRF protection. The fix in version 2.19.0 likely introduces CSRF tokens or SameSite cookie attributes.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.19.0): The vulnerable code lacks CSRF protection. For example, a typical API endpoint might look like this:

# vulnerable_app.py
from flask import Flask, request, session, jsonify

app = Flask(__name__)

@app.route('/api/tasks/<task_id>', methods=['DELETE'])
def delete_task(task_id):
    if 'user_id' not in session:
        return jsonify({'error': 'Unauthorized'}), 401
    # No CSRF check
    task = Task.query.get(task_id)
    if task:
        db.session.delete(task)
        db.session.commit()
        return jsonify({'message': 'Task deleted'}), 200
    return jsonify({'error': 'Not found'}), 404

Patched Code (2.19.0+): The patched code includes CSRF token validation:

# patched_app.py
from flask import Flask, request, session, jsonify, abort
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
csrf = CSRFProtect(app)

@app.route('/api/tasks/<task_id>', methods=['DELETE'])
@csrf.exempt  # Or use CSRF token check
def delete_task(task_id):
    if 'user_id' not in session:
        return jsonify({'error': 'Unauthorized'}), 401
    # CSRF token is validated by CSRFProtect middleware
    task = Task.query.get(task_id)
    if task:
        db.session.delete(task)
        db.session.commit()
        return jsonify({'message': 'Task deleted'}), 200
    return jsonify({'error': 'Not found'}), 404

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A CVAT instance (version < 2.19.0) accessible over the network.
• A valid attacker account with permissions to create or edit tasks.
• A victim account that is logged into CVAT.

Exploitation Steps:

1. Log into CVAT as the attacker.
2. Create a new task or edit an existing one. In the task description or name, include a link to a malicious URL. For example:

   <a href="http://victim-cvat-instance/api/tasks/123/delete">Click here for more info</a>
   

3. Send the task link to the victim via social engineering.
4. When the victim clicks the link, the browser sends a DELETE request to /api/tasks/123/delete with the victim's session cookie.
5. The task is deleted, or other API calls can be crafted to exfiltrate data.

Example Malicious URL:

http://victim-cvat-instance/api/tasks/123/delete

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual API requests that originate from external referrers or have unexpected user agents.
• Look for patterns of multiple API calls from a single IP to different endpoints in a short time.
• Check for requests to sensitive endpoints (e.g., DELETE, PUT) that are not preceded by a GET request (which would fetch a CSRF token).

Defense:

• Upgrade to CVAT 2.19.0 or later.
• Implement CSRF tokens on all state-changing API endpoints.
• Use SameSite cookies (e.g., SameSite=Strict or Lax).
• Add additional authentication headers (e.g., X-CSRF-Token) that are validated server-side.
• Educate users about phishing attacks and not clicking on suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API requests to /api/* endpoints with methods other than GET, especially from external referrers.
  • Requests with Referer header pointing to a different domain or a task page.
• Host IOCs:
  • CVAT server logs showing multiple failed CSRF token validations (if patched).
  • Unexpected task deletions or modifications.
• User IOCs:
  • Victim user reports of unauthorized actions on their account.

Detection Engineering

YARA Rule

rule CVE_2024_47063_CSRF_Exploit {
    meta:
        description = "Detects potential CSRF exploit attempts against CVAT CVE-2024-47063"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47063"
    strings:
        $s1 = "/api/" ascii wide nocase
        $s2 = "DELETE" ascii wide nocase
        $s3 = "PUT" ascii wide nocase
        $s4 = "POST" ascii wide nocase
        $s5 = "Referer:" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4) and $s5
}

Sigma Rule

title: CVE-2024-47063 CVAT CSRF Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to CVAT API endpoints that may indicate CSRF exploitation
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 
            - 'DELETE'
            - 'PUT'
            - 'POST'
        cs-uri-stem|startswith: '/api/'
        cs-referer|contains: 
            - 'http://'
            - 'https://'
    condition: selection
falsepositives:
    - Legitimate API calls from the CVAT frontend
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47063 CVAT CSRF Exploit Attempt"; flow:to_server; content:"/api/"; http_uri; content:"DELETE"; http_method; content:"Referer"; http_header; pcre:"/Referer:\s*https?:\/\//"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all CVAT instances to version 2.19.0 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /api/* endpoints that do not include a valid CSRF token.
3. Restrict network access to the CVAT instance to trusted IPs only.

Long-term Mitigations:

• Enforce CSRF protection on all state-changing API endpoints.
• Use SameSite cookies with Strict or Lax attribute.
• Implement additional authentication mechanisms such as API keys or OAuth for API access.
• Conduct regular security audits and penetration testing.

Patch Details:

• Upgrade to CVAT 2.19.0 from the official GitHub repository: https://github.com/cvat-ai/cvat/releases/tag/v2.19.0
• The patch introduces CSRF token validation and likely updates the session handling.

Valters IT