ExploitCVE-2024-9324
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
A critical vulnerability has been discovered in Intelbras InControl versions up to 2.21.57. The vulnerability affects the /v1/operador/ file of the Relatório de Operadores Page component. It allows for code injection through the manipulation of argument fields. This is a remotely exploitable vulnerability that requires low attack complexity and low privileges.
Impact
The potential impact of this vulnerability is severe. It has been rated as critical with a CVSS v3.1 base score of 8.8 out of 10. The vulnerability affects all three key aspects of security: 1. Confidentiality: High impact - unauthorized access to sensitive information is possible. 2. Integrity: High impact - data integrity could be compromised, allowing attackers to modify information. 3. Availability: High impact - system availability could be disrupted. Given that the exploit has been publicly disclosed, there is an increased risk of active exploitation in the wild. This vulnerability could allow attackers to execute arbitrary code on the affected systems, potentially leading to full system compromise, data theft, or service disruption.
Exploitation
One proof-of-concept exploit is available on vuldb.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is not currently available, but a fix is scheduled for release. Version 2.21.58, which addresses this vulnerability, was initially announced for release at the end of August 2024 but has been postponed to September 20, 2024. It is crucial to plan for immediate patching once the fixed version becomes available.
Mitigation
Until the patch is available, consider the following mitigation strategies: 1. Implement strict network segmentation to limit access to the affected systems. 2. Enhance monitoring for any suspicious activities, particularly those targeting the /v1/operador/ endpoint. 3. If possible, temporarily disable or restrict access to the Relatório de Operadores Page component. 4. Apply the principle of least privilege to limit the potential impact of successful exploitation. 5. Regularly back up critical data and systems to ensure quick recovery in case of a successful attack. 6. Stay informed about the upcoming patch release and prepare for immediate deployment when it becomes available on September 20, 2024. Given the critical nature of this vulnerability and its public disclosure, it should be given high priority in your patching and remediation efforts. Prepare your systems and teams for rapid deployment of the patch as soon as it is released.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-9324. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9324
A CVSS base score of 6.3 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.3%)
A CVSS base score of 8.8 has been assigned.