CVE-2024-56113

Executive Summary

CVE-2024-56113 exposes a critical information disclosure vulnerability in Smart Toilet Lab - Motius version 1.3.11. The application is running with Django debug mode enabled (DEBUG = True), which causes verbose error pages to be displayed to unauthenticated remote attackers. These error pages leak sensitive configuration data from the Django settings file, including secret keys, database credentials, API tokens, and other environment variables. This vulnerability requires no authentication and can be exploited simply by triggering an application error.

Supply Chain & Package Security

This vulnerability is specific to the Smart Toilet Lab - Motius application, which is a Python/Django-based project. The issue is not in a package dependency but in the application's deployment configuration. However, the leaked credentials could compromise the entire supply chain if the database or external services are accessed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full disclosure of sensitive configuration data.
• Integrity (I): None (N) - No data modification possible.
• Availability (A): None (N) - No denial of service.

CVSS Score: 7.5 (High) - The high confidentiality impact drives the score, as the leaked data can lead to further compromise.

Deep Dive & Mechanics

The vulnerability stems from Django's debug mode. When DEBUG = True is set in the settings.py file, Django displays detailed error pages (e.g., 500 errors) that include:

• Full Python traceback
• Local variables at each stack frame
• Django settings (including SECRET_KEY, DATABASES, EMAIL_HOST_PASSWORD, etc.)
• Request information (headers, GET/POST data)

An attacker can trigger an error by sending malformed requests, accessing non-existent endpoints, or exploiting other application bugs. The verbose error page is rendered with all sensitive data embedded in the HTML response.

Key leaked items:

• SECRET_KEY: Used for session signing, CSRF tokens, and password reset tokens.
• DATABASES: Database credentials (host, port, user, password).
• EMAIL_HOST_PASSWORD: SMTP credentials.
• ALLOWED_HOSTS: Internal network structure.
• INSTALLED_APPS: Application stack.

Vulnerable vs. Patched Code

Vulnerable (DEBUG = True):

# settings.py
DEBUG = True
ALLOWED_HOSTS = ['*']

Patched (DEBUG = False):

# settings.py
DEBUG = False
ALLOWED_HOSTS = ['yourdomain.com']

The patch is simply setting DEBUG = False in production and properly configuring ALLOWED_HOSTS. No code changes are needed beyond this configuration fix.

Exploitation & Lab Setup

Red Team

Step 1: Identify the target Use Shodan or manual scanning to find instances of Smart Toilet Lab - Motius. Look for Django error pages or default endpoints.

Step 2: Trigger an error Send a request to a non-existent endpoint or provide invalid input:

curl -v http://target.com/nonexistent

Step 3: Extract sensitive data The response will contain a verbose error page. Parse the HTML for the settings block:

curl -s http://target.com/nonexistent | grep -oP 'SECRET_KEY.*?[^<]+'

Step 4: Exploit leaked credentials Use the leaked SECRET_KEY to forge session cookies or decrypt sensitive data. Use database credentials to connect directly:

psql -h target.com -U leaked_user -d leaked_db

Blue Team

Detection:

• Monitor for requests to non-existent endpoints that return 500 errors.
• Look for error pages containing "DJANGO_SETTINGS_MODULE" or "SECRET_KEY" in the response body.
• Alert on any response containing DEBUG = True or settings.py content.

Hunting:

• Search logs for 500 status codes with response bodies larger than 10KB.
• Check for Traceback or File " patterns in HTTP responses.

Containment:

• Immediately set DEBUG = False in production.
• Rotate all secrets exposed (SECRET_KEY, database passwords, API keys).
• Restrict access to error pages via WAF rules.

Indicators of Compromise (IOCs)

• Network: HTTP responses with status 500 and body containing DJANGO_SETTINGS_MODULE, SECRET_KEY, or DEBUG = True.
• File: Access to /settings.py or /nonexistent endpoints.
• Behavior: Unusual database connections from external IPs after error page exposure.
• Logs: Repeated 500 errors with large response sizes.

Detection Engineering

YARA Rule

rule django_debug_info_leak {
    meta:
        description = "Detects Django verbose error pages leaking settings"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56113"
    strings:
        $s1 = "DJANGO_SETTINGS_MODULE" ascii wide
        $s2 = "SECRET_KEY" ascii wide
        $s3 = "DEBUG = True" ascii wide
        $s4 = "Traceback (most recent call last)" ascii wide
        $s5 = "settings.py" ascii wide
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: Django Debug Mode Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing Django debug error pages
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        status_code: 500
        response_body|contains:
            - 'DJANGO_SETTINGS_MODULE'
            - 'SECRET_KEY'
            - 'DEBUG = True'
            - 'Traceback (most recent call last)'
    condition: selection
falsepositives:
    - Legitimate debugging in development environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56113 Django Debug Mode Info Leak"; flow:to_client; content:"DJANGO_SETTINGS_MODULE"; http_server_body; content:"SECRET_KEY"; http_server_body; content:"DEBUG = True"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Set DEBUG = False in the production settings.py file.
2. Configuration: Ensure ALLOWED_HOSTS is properly configured to only accept requests from legitimate domains.
3. Secrets Rotation: Rotate all secrets that may have been exposed (SECRET_KEY, database passwords, API keys, email credentials).
4. Monitoring: Implement logging and alerting for 500 errors with large response bodies.
5. WAF Rules: Block responses containing DJANGO_SETTINGS_MODULE or SECRET_KEY.
6. Network Segmentation: Restrict database and internal service access to only trusted IPs.
7. Code Review: Check for any other debug endpoints or verbose error handling in the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert