CVE-2026-15375

Executive Summary

CVE-2026-15375 is a critical improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/users_ldap.jsp file within the LDAP User Interface component, allowing remote attackers to bypass authorization checks and potentially gain unauthorized access to sensitive LDAP configuration and user data. The vendor has not responded to disclosure, and no patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full LDAP data exposure.
• Integrity Impact: High (I:H) – Potential to modify LDAP configurations.
• Availability Impact: High (A:H) – Could disrupt LDAP authentication services.

Deep Dive & Mechanics

The vulnerability exists in the LDAP User Interface component of Eleveo Call Recording Software, specifically in the /callrec/users_ldap.jsp page. This page is intended to manage LDAP user synchronization and authentication settings. The flaw is a classic improper authorization (CWE-285) where the server fails to validate whether the requesting user has the necessary privileges to access or modify LDAP configurations.

Attack Vector: An unauthenticated attacker can send crafted HTTP requests to the vulnerable endpoint. By manipulating parameters or directly accessing the JSP page, the attacker can bypass access controls and perform actions such as:

• Viewing LDAP server credentials (bind DN, passwords).
• Modifying LDAP connection strings.
• Adding or removing LDAP users.
• Potentially pivoting to the LDAP server itself if credentials are exposed.

Root Cause: The application does not enforce session-based or role-based access control on the /callrec/users_ldap.jsp endpoint. The JSP page likely relies on client-side checks or missing server-side authorization filters.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be the entire /callrec/users_ldap.jsp file. A patched version would include server-side authorization checks, such as:

Vulnerable (pseudo-code):

<%-- No authorization check --%>
<%
    String action = request.getParameter("action");
    if ("getUsers".equals(action)) {
        // Returns LDAP users without checking privileges
    }
%>

Patched (pseudo-code):

<%
    // Server-side authorization check
    if (session.getAttribute("user") == null || !"admin".equals(session.getAttribute("role"))) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String action = request.getParameter("action");
    if ("getUsers".equals(action)) {
        // Proceed only if authorized
    }
%>

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Eleveo Call Recording Software 9.7.0 in a controlled environment.
2. Ensure the LDAP User Interface is accessible via HTTP on port 8080 (default).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target:8080/callrec/users_ldap.jsp
   

2. Attempt to access the page without authentication:

   curl -v http://target:8080/callrec/users_ldap.jsp
   

3. If successful, enumerate LDAP users:

   curl "http://target:8080/callrec/users_ldap.jsp?action=getUsers"
   

4. Extract LDAP credentials (if exposed):

   curl "http://target:8080/callrec/users_ldap.jsp?action=getConfig"
   

Expected Output:

• HTTP 200 response with LDAP user data or configuration details.
• No authentication challenge.

Blue Team

Detection:

• Monitor for unusual access to /callrec/users_ldap.jsp from unauthenticated sources.
• Alert on requests with parameters like action=getUsers or action=getConfig without prior login.

Hunting:

• Search web server logs for users_ldap.jsp requests with no preceding login event.
• Look for anomalous IPs accessing the LDAP interface outside of business hours.

Mitigation:

• Immediately restrict access to /callrec/users_ldap.jsp via firewall or web application firewall (WAF) rules.
• Implement virtual patching by adding a reverse proxy that enforces authentication.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /callrec/users_ldap.jsp with parameters action=getUsers, action=getConfig, action=addUser.
  • Source IPs not in the trusted admin range.
• File:
  • Unauthorized modifications to LDAP configuration files (e.g., ldap_config.xml).
• Log:
  • Web server logs showing 200 responses to /callrec/users_ldap.jsp without prior authentication.
  • LDAP server logs showing unexpected queries from the Eleveo server.

Detection Engineering

YARA Rule

rule detect_eleveo_ldap_exploit {
    meta:
        description = "Detects exploitation attempts against CVE-2026-15375 in Eleveo Call Recording"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/callrec/users_ldap.jsp" ascii wide nocase
        $s2 = "action=getUsers" ascii wide nocase
        $s3 = "action=getConfig" ascii wide nocase
        $s4 = "action=addUser" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: Eleveo LDAP Interface Unauthorized Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the Eleveo LDAP User Interface
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/callrec/users_ldap.jsp'
        cs-method: 'GET'
        sc-status: 200
    filter:
        c-ip: '127.0.0.1'  # Adjust to trusted IPs
    condition: selection and not filter
falsepositives:
    - Legitimate admin access from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-15375 Eleveo LDAP Interface Exploit"; flow:to_server,established; content:"/callrec/users_ldap.jsp"; http_uri; content:"action="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the Eleveo server from untrusted networks.
2. WAF Rules: Block access to /callrec/users_ldap.jsp for all IPs except trusted admin ranges.
3. Authentication Enforcement: If possible, add a reverse proxy (e.g., Nginx) that requires HTTP Basic Auth before proxying to the vulnerable endpoint.

Long-Term Fix:

• Since no vendor patch exists, consider migrating to an alternative call recording solution or applying custom code fixes:
  • Add server-side authorization checks in the JSP file.
  • Implement role-based access control (RBAC) for all administrative interfaces.

Workaround:

• Disable the LDAP User Interface entirely if not in use by removing or renaming the users_ldap.jsp file.

Valters IT
DevSecOps & Cyber Threat Intelligence