CVE-2026-15376

Executive Summary

CVE-2026-15376 is a critical improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/statisticReportAction.do endpoint, allowing unauthenticated remote attackers to access sensitive call recording statistics and potentially manipulate reporting data. The vendor has not responded to disclosure, and no patch is available. Public exploit code has been released, increasing the risk of active exploitation.

This vulnerability is not related to a WordPress plugin or component; it is a standalone enterprise application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Exposure of sensitive call recording metadata.
• Integrity (I): Low (L) – Potential to modify report data.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: High (CVSS 8.2) – Public exploit, no patch, remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic Improper Authorization (CWE-285) in the statisticReportAction.do servlet. The application fails to validate user session or role before processing requests to this endpoint. By sending a crafted HTTP GET or POST request to /callrec/statisticReportAction.do, an attacker can:

• Retrieve detailed call statistics (caller ID, duration, timestamps, recording metadata).
• Modify report parameters to access data from other tenants or time periods.
• Potentially trigger server-side actions (e.g., report generation, data export) without proper access controls.

The lack of any authentication check means the endpoint treats all requests as authorized, exposing internal business logic and sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the production version 9.7.0. A hypothetical patched version would include:

Vulnerable (9.7.0):

// No session validation
public void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String action = req.getParameter("action");
    // Directly processes request without checking user role
    processStatisticReport(action, req, resp);
}

Patched (Hypothetical):

public void doGet(HttpServletRequest req, HttpServletResponse resp) {
    // Validate user session and role
    UserSession session = (UserSession) req.getSession().getAttribute("user");
    if (session == null || !session.hasRole("ADMIN")) {
        resp.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String action = req.getParameter("action");
    processStatisticReport(action, req, resp);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Eleveo Call Recording 9.7.0
• Network access to the /callrec/statisticReportAction.do endpoint

Exploit Steps:

1. Identify the target: https://target.com/callrec/statisticReportAction.do
2. Send a crafted request to retrieve statistics:

curl -X GET "https://target.com/callrec/statisticReportAction.do?action=getStats&startDate=2026-01-01&endDate=2026-12-31"

3. Parse the JSON/XML response to extract call metadata.

Advanced exploitation may involve parameter manipulation to access other tenants' data:

curl -X POST "https://target.com/callrec/statisticReportAction.do" \
  -d "action=exportReport&format=csv&tenantId=2"

Blue Team (Detection & Response)

Detection:

• Monitor for requests to /callrec/statisticReportAction.do without prior authentication.
• Alert on unusual parameter combinations (e.g., tenantId changes, large date ranges).
• Correlate with failed login attempts or session anomalies.

Response:

1. Immediately block the endpoint at the WAF or reverse proxy.
2. Review access logs for unauthorized requests.
3. Rotate any exposed API keys or tokens.
4. Contact Eleveo for emergency patch or workaround.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule detect_eleveo_exploit {
    meta:
        description = "Detects exploitation attempts against CVE-2026-15376"
        author = "Valters IT"
        date = "2026-01-01"
    strings:
        $endpoint = "/callrec/statisticReportAction.do"
        $action1 = "action=getStats"
        $action2 = "action=exportReport"
        $tenant = "tenantId="
    condition:
        $endpoint and ($action1 or $action2) and $tenant
}

Sigma Rule

title: Eleveo Call Recording Unauthorized Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the statisticReportAction.do endpoint
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/callrec/statisticReportAction.do'
        cs-method: 'GET' or 'POST'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-15376 Eleveo Call Recording Unauthorized Access";
    flow:to_server;
    content:"/callrec/statisticReportAction.do"; http_uri;
    content:"action="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. WAF Rule: Block all requests to /callrec/statisticReportAction.do from untrusted networks.
2. Network Segmentation: Restrict access to the Eleveo server to only authorized IP ranges.
3. Authentication Enforcement: If possible, add a reverse proxy (e.g., Nginx) that requires authentication before proxying to the vulnerable endpoint.

Long-term Fix:

• Contact Eleveo for an official patch or upgrade to a non-vulnerable version.
• Implement proper session validation and role-based access control in the application.
• Conduct a full security audit of all servlets and endpoints.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters-it.com.