CVE-2024-9097

Executive Summary

CVE-2024-9097 is an Insecure Direct Object Reference (IDOR) vulnerability in ManageEngine Endpoint Central, affecting versions prior to 11.3.2440.09. The vulnerability allows an authenticated attacker to change the username in the chat feature by manipulating direct object references. With a CVSS score of 3.5 (Low), the impact is limited to integrity compromise of chat usernames, but it could be leveraged for social engineering or impersonation attacks within the organization. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise software product (ManageEngine Endpoint Central) and does not involve open-source package supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker must have valid credentials to the chat feature.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – The attacker can modify the username in chat.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The vulnerability requires authentication and only allows modification of chat usernames, limiting its direct impact. However, it could be used in conjunction with social engineering attacks.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (IDOR) in the chat feature of ManageEngine Endpoint Central. The application likely uses a direct object reference (e.g., a user ID or chat session ID) to identify which username to display or modify. An attacker can intercept or craft requests to change this reference, allowing them to alter the username associated with a chat session.

Root Cause: The application fails to verify that the authenticated user is authorized to modify the target object (username). The server trusts the client-supplied object reference without proper access control checks.

Attack Flow:

1. An authenticated user logs into the chat feature.
2. The user intercepts a request (e.g., via Burp Suite) that updates the chat username.
3. The user modifies the request to change the object reference (e.g., user_id=123 to user_id=456).
4. The server processes the request and changes the username for the targeted user.
5. The attacker can now impersonate another user in the chat.

Impact: An attacker could impersonate a manager, IT admin, or other trusted user to send fraudulent messages, potentially leading to phishing or social engineering attacks within the organization.

Vulnerable vs. Patched Code

No specific code snippets are available from the advisory. However, the patched version (11.3.2440.09) likely implements proper authorization checks on the server side.

Vulnerable Code (Conceptual):

# Vulnerable: No authorization check
def update_chat_username(request):
    user_id = request.POST.get('user_id')
    new_username = request.POST.get('username')
    # Directly updates the username for the given user_id
    db.execute("UPDATE users SET chat_username = ? WHERE id = ?", (new_username, user_id))

Patched Code (Conceptual):

# Patched: Authorization check added
def update_chat_username(request):
    current_user_id = request.session.get('user_id')
    target_user_id = request.POST.get('user_id')
    if current_user_id != target_user_id:
        return "Unauthorized", 403
    new_username = request.POST.get('username')
    db.execute("UPDATE users SET chat_username = ? WHERE id = ?", (new_username, target_user_id))

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for the ManageEngine Endpoint Central chat feature.
• Network access to the application.
• A tool like Burp Suite or cURL.

Steps:

1. Log in to the chat feature.
2. Intercept a request that changes the chat username (e.g., via Burp Suite).
3. Modify the request to target a different user ID.
4. Send the modified request.
5. Verify that the username has been changed for the target user.

Example cURL Command:

# Replace with actual endpoint and parameters
curl -X POST https://target.com/chat/update_username \
  -H "Cookie: session=valid_session_cookie" \
  -d "user_id=456&username=ImpersonatedUser"

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual changes to chat usernames, especially if multiple changes occur in a short time.
• Log all requests to the chat username update endpoint and alert on anomalies.
• Use Web Application Firewall (WAF) rules to block requests with manipulated object references.

Defense:

• Apply the vendor patch immediately.
• Implement strict server-side authorization checks for all object references.
• Use random, non-sequential identifiers for user objects.
• Enable audit logging for all chat-related actions.

Indicators of Compromise (IOCs)

• Network Indicators:

  • Unusual POST requests to /chat/update_username or similar endpoints with modified user_id parameters.
  • Repeated attempts to change usernames for multiple users from a single session.

• Log Indicators:

  • Log entries showing username changes for users other than the authenticated user.
  • Multiple failed authorization attempts (if patched) from the same IP.

• Endpoint Indicators:

  • Unexpected changes to chat usernames in the application database.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_9097_IDOR_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2024-9097 IDOR vulnerability in ManageEngine Endpoint Central chat"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9097"
    strings:
        $s1 = "update_username" nocase
        $s2 = "user_id=" nocase
        $s3 = "chat_username" nocase
    condition:
        all of them
}

Sigma Rule

title: Detect CVE-2024-9097 IDOR Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit IDOR vulnerability in ManageEngine Endpoint Central chat username update
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'update_username'
        cs-uri-query|contains: 'user_id='
    condition: selection
falsepositives:
    - Legitimate username changes by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9097 IDOR Exploitation Attempt - ManageEngine Endpoint Central Chat Username Change";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"update_username"; http_uri;
    content:"user_id="; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-9097;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ManageEngine Endpoint Central to version 11.3.2440.09 or later.
2. If immediate patching is not possible, restrict access to the chat feature to trusted users only.
3. Implement additional monitoring on the chat username update endpoint.

Long-Term Measures:

• Conduct a security review of all object references in the application.
• Implement robust server-side authorization checks.
• Use indirect object references (e.g., random tokens) instead of direct IDs.
• Enable comprehensive audit logging for all administrative and chat actions.

Workarounds:

• Disable the chat feature temporarily if it is not critical.
• Use a Web Application Firewall (WAF) to block requests with suspicious user_id parameters.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert