CVE-2024-54147

Executive Summary

CVE-2024-54147 is a critical security vulnerability in the Altair GraphQL Client desktop application. The flaw stems from the application's failure to properly validate HTTPS certificates, making it susceptible to Man-in-the-Middle (MitM) attacks. An attacker positioned on an untrusted network (e.g., public Wi-Fi, compromised DNS) can intercept all GraphQL requests and responses, including sensitive headers and bodies. This allows for the theft of authentication tokens, full compromise of any signed-in Altair GraphQL Cloud account, and the potential to redirect payment checkout pages to malicious sites. The vulnerability is assigned a CVSS score of 6.8 (Medium) and affects all versions prior to 8.0.5. The patch is available in version 8.0.5.

Supply Chain & Package Security

This vulnerability is specific to the Altair GraphQL Client desktop application, which is distributed as a standalone binary. It is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain security concerns are limited to the integrity of the binary distribution channels. Users should ensure they download the patched version (8.0.5) only from the official Altair GitHub releases page or the official website.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
• Base Score: 6.8 (Medium)
• Attack Vector (AV): Network (N) - The attack can be executed remotely over a network.
• Attack Complexity (AC): High (H) - The attacker must be on the same network segment as the victim (e.g., public Wi-Fi) and perform a MitM attack.
• Privileges Required (PR): None (N) - No prior authentication is needed.
• User Interaction (UI): Required (R) - The victim must be using the Altair client on an untrusted network.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - All GraphQL request/response data, including authentication tokens, can be exposed.
• Integrity (I): High (H) - An attacker can modify requests/responses, potentially redirecting payment pages or injecting malicious data.
• Availability (A): None (N) - The vulnerability does not directly impact availability.

Threat Level: Medium. While the CVSS score is 6.8, the potential impact on confidentiality and integrity is high, especially for users on untrusted networks. The attack complexity is high, requiring a MitM position.

Deep Dive & Mechanics

The Altair GraphQL Client desktop application, prior to version 8.0.5, was built using Electron or a similar framework that relies on the system's certificate store for HTTPS validation. The vulnerability arises because the application was configured to ignore certificate validation errors, effectively disabling TLS/SSL security. This is often done during development for testing purposes but was inadvertently left enabled in the production build.

Attack Flow:

1. Precondition: The victim is connected to an untrusted network (e.g., public Wi-Fi at a coffee shop, airport, or a network with a malicious DNS server).
2. Positioning: The attacker establishes a Man-in-the-Middle position. This can be achieved through ARP spoofing, DNS spoofing, or by setting up a rogue access point.
3. Interception: When the victim's Altair client makes a GraphQL request (e.g., to https://api.example.com/graphql), the attacker intercepts the connection.
4. Certificate Bypass: The attacker presents a self-signed or invalid certificate. Normally, the client would reject this. However, due to the vulnerability, the Altair client accepts the invalid certificate and establishes a TLS connection with the attacker.
5. Data Exfiltration: The attacker can now read all data in the GraphQL request (including Authorization: Bearer <token> headers) and response. They can also modify the request or response in transit.
6. Account Takeover: With the stolen authentication token, the attacker can impersonate the victim on the Altair GraphQL Cloud platform.
7. Payment Redirection: If the victim uses the Altair client to interact with a payment gateway, the attacker can modify the response to redirect the user to a phishing site.

Vulnerable vs. Patched Code

The core issue is the use of an insecure HTTP client configuration that disables certificate validation.

Vulnerable Code (Conceptual - Pre-8.0.5):

// Insecure HTTP client configuration
const https = require('https');
const agent = new https.Agent({
  rejectUnauthorized: false // <-- This is the vulnerability
});

// Making a request
const options = {
  hostname: 'api.example.com',
  port: 443,
  path: '/graphql',
  method: 'POST',
  agent: agent,
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + authToken
  }
};

const req = https.request(options, (res) => {
  // Process response
});

Patched Code (Conceptual - 8.0.5):

// Secure HTTP client configuration
const https = require('https');
const agent = new https.Agent({
  rejectUnauthorized: true // <-- Certificate validation is now enforced
});

// Making a request
const options = {
  hostname: 'api.example.com',
  port: 443,
  path: '/graphql',
  method: 'POST',
  agent: agent,
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + authToken
  }
};

const req = https.request(options, (res) => {
  // Process response
});

The fix is a single line change: setting rejectUnauthorized from false to true. This ensures that the client will only establish a TLS connection if the server presents a valid certificate signed by a trusted Certificate Authority (CA).

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Attacker Machine: Kali Linux with mitmproxy or bettercap installed.
2. Victim Machine: Windows/macOS/Linux with Altair GraphQL Client < 8.0.5 installed.
3. Network: Both machines on the same local network (e.g., a virtual NAT network in VMware/VirtualBox).

Exploitation Steps:

1. Enable IP Forwarding (on Attacker):

   echo 1 > /proc/sys/net/ipv4/ip_forward
   

2. ARP Spoofing (using bettercap):

   sudo bettercap -eval "set arp.spoof.targets <VICTIM_IP>; arp.spoof on"
   

3. Start mitmproxy:

   mitmproxy --mode transparent --listen-port 8080
   

4. Redirect Traffic (using iptables):

   sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
   

5. Intercept Traffic: On the victim machine, use the Altair client to make a GraphQL request. In mitmproxy, you will see the full request and response, including any authentication tokens.

Expected Outcome: The attacker can see all GraphQL traffic in plaintext, including Authorization headers, query variables, and response data.

Blue Team (Detection & Response)

Detection:

• Network Monitoring: Look for unusual TLS handshake patterns, especially the acceptance of self-signed certificates. Monitor for ARP spoofing attacks (e.g., duplicate IP addresses in ARP tables).
• Endpoint Detection: Monitor for the Altair client process making connections to unexpected IP addresses or domains. Check for the presence of rejectUnauthorized: false in any configuration files.
• Log Analysis: Review Altair client logs for any errors related to certificate validation.

Response:

1. Immediate: Disconnect the affected machine from the network.
2. Containment: Revoke any authentication tokens that may have been exposed.
3. Eradication: Upgrade the Altair client to version 8.0.5 or later.
4. Recovery: Change passwords for any accounts that may have been compromised.
5. Post-Incident: Conduct a thorough investigation to determine the scope of the breach.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TLS connections to unexpected IP addresses on port 443.
  • Presence of self-signed or invalid certificates in TLS handshakes.
  • ARP spoofing indicators (e.g., multiple MAC addresses for the same IP).
• Host IOCs:
  • Altair GraphQL Client version < 8.0.5.
  • Presence of rejectUnauthorized: false in Altair configuration files (e.g., settings.json).
  • Unusual outbound connections from the Altair process.
• Behavioral IOCs:
  • Sudden changes in GraphQL API behavior (e.g., unexpected responses, redirects).
  • Unauthorized access to Altair GraphQL Cloud accounts.

Detection Engineering

YARA Rule

rule Detect_Altair_Insecure_Config {
    meta:
        description = "Detects Altair GraphQL Client configuration files with disabled certificate validation"
        author = "Valters IT"
        date = "2024-12-11"
        reference = "CVE-2024-54147"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "rejectUnauthorized" nocase
        $s2 = "false" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Altair GraphQL Client Insecure Certificate Validation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the use of Altair GraphQL Client with disabled certificate validation (CVE-2024-54147)
author: Valters IT
date: 2024/12/11
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54147
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Altair GraphQL Client.exe'
        CommandLine|contains: 'rejectUnauthorized=false'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-54147 - Altair GraphQL Client Accepting Invalid Certificate"; flow:to_server; tls.cert_issuer:"CN=*"; tls.cert_subject:"CN=*"; tls.cert_notbefore:"*"; tls.cert_notafter:"*"; tls.cert_serial:"*"; tls.cert_fingerprint:"*"; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder. A more effective rule would need to detect the specific behavior of the Altair client, which may require custom Lua scripting or matching on specific JA3 fingerprints.

Remediation & Mitigation

Immediate Remediation:

• Upgrade: Update Altair GraphQL Client to version 8.0.5 or later. This is the only complete fix.
• Download: Obtain the patched version from the official GitHub repository: https://github.com/altair-graphql/altair/releases

Mitigation (if upgrade is not immediately possible):

• Network Segmentation: Avoid using the Altair client on untrusted networks (e.g., public Wi-Fi). Use a VPN to create a secure tunnel.
• Certificate Pinning: If you control the GraphQL API, implement certificate pinning on the server side. This will not fix the client, but it will make MitM attacks more difficult.
• Network Monitoring: Deploy network monitoring tools to detect ARP spoofing and other MitM techniques.
• User Awareness: Educate users about the risks of using the Altair client on untrusted networks.

Long-Term Prevention:

• Secure Development Practices: Ensure that all applications, especially those handling sensitive data, enforce proper TLS certificate validation.
• Code Review: Implement mandatory code reviews to catch insecure configurations like rejectUnauthorized: false.
• Static Analysis: Use static application security testing (SAST) tools to automatically detect such vulnerabilities.

Valters IT
Securing Digital Frontiers