Overview
This article discusses the CVE-2024-57190, a vulnerability discovered in versions of Erxes prior to 1.6.1. The vulnerability, classified as Incorrect Access Control, allows attackers to bypass authentication and potentially compromise the system or leak data. Given the severity of the vulnerability, it poses a significant threat to organizations using affected versions of Erxes. It’s therefore crucial to understand the vulnerability, its impact, and how to mitigate it.
Vulnerability Summary
CVE ID: CVE-2024-57190
Severity: Critical (CVSS score: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise and Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Erxes | <1.6.1 How the Exploit Works
The exploit takes advantage of an Incorrect Access Control vulnerability in Erxes. Specifically, an attacker can bypass the authentication mechanism by supplying a “User” HTTP header that contains any user. This allows the attacker to converse with any GraphQL endpoint, potentially leading to unauthorized access to sensitive information and system resources.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. This HTTP request includes a “User” HTTP header that falsely represents the attacker as a valid user.
GET /graphql-endpoint HTTP/1.1
Host: target.example.com
User: AttackerIn this example, the “User” header contains “Attacker”, which allows the attacker to bypass the authentication mechanism and access the GraphQL endpoint.
Mitigation
The best way to address this vulnerability is to apply the vendor-supplied patch. Users should upgrade to Erxes version 1.6.1 or later. If for some reason upgrading isn’t immediately possible, a temporary mitigation measure could involve using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block any suspicious activities. However, this should be seen as a temporary solution, as it doesn’t address the root cause of the vulnerability.
Organizations are strongly advised to follow a proactive approach to their cybersecurity strategy. Regularly updating and patching software can help prevent most common vulnerabilities.