CVE-2024-0413: Csdeshang Dskms Auth Bypass Vulnerability

CVE-2024-0413 Overview

A critical improper access control vulnerability has been identified in DeShang DSKMS (CSDeshang Knowledge Management System) up to version 3.1.2. The vulnerability exists in the file public/install.php, where improper access controls allow unauthenticated remote attackers to potentially reinitialize or manipulate the installation process. This flaw can lead to complete system compromise, including unauthorized access, data manipulation, and potential takeover of the affected system.

Critical Impact

Remote attackers can exploit improper access controls in the installation script to potentially compromise the entire DSKMS installation without authentication.

Affected Products

• CSDeshang DSKMS versions up to and including 3.1.2
• Installations with the public/install.php file accessible via web

Discovery Timeline

• 2024-01-11 - CVE-2024-0413 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0413

Vulnerability Analysis

This vulnerability stems from inadequate access control mechanisms in the installation script (public/install.php) of the DeShang DSKMS application. The installation script, which should only be accessible during initial setup and protected or removed afterward, remains accessible to remote attackers. This allows manipulation of the installation process, potentially enabling attackers to reconfigure the system, reset administrative credentials, or inject malicious configurations.

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the application fails to properly restrict access to the installation functionality. Since the attack requires no authentication or user interaction and can be conducted remotely over the network, the potential impact on confidentiality, integrity, and availability is significant.

Root Cause

The root cause lies in the failure to implement proper access controls on the public/install.php file. The installation script should either be removed after initial setup, protected by authentication mechanisms, or include checks to determine whether the system has already been installed. The absence of these controls allows any remote attacker to access and potentially exploit the installation functionality.

Attack Vector

The attack can be initiated remotely over the network. An attacker can directly access the public/install.php endpoint without requiring any prior authentication or privileges. The exploitation details have been publicly disclosed, making this vulnerability particularly dangerous for exposed DSKMS installations.

The vulnerability mechanism involves accessing the unprotected installation script at the public/install.php path. Once accessed, an attacker could potentially manipulate database configurations, create new administrative accounts, or reset existing configurations. For technical exploitation details, refer to the Zhaoj Blog Post or the VulDB entry #250433.

Detection Methods for CVE-2024-0413

Indicators of Compromise

• Unexpected HTTP requests to /public/install.php or similar installation endpoints
• Unauthorized changes to database configurations or administrative credentials
• Access logs showing successful responses (HTTP 200) to installation script requests from external IP addresses
• New or modified administrator accounts that were not created by legitimate users

Detection Strategies

• Monitor web server access logs for any requests targeting install.php or installation-related endpoints
• Implement Web Application Firewall (WAF) rules to block access to installation scripts from external networks
• Configure intrusion detection systems (IDS) to alert on installation endpoint access attempts
• Review application logs for signs of configuration changes or database modifications

Monitoring Recommendations

• Set up real-time alerting for any access attempts to public/install.php
• Periodically audit file system permissions and ensure installation scripts are not web-accessible
• Monitor for changes to application configuration files and database schema
• Track administrative account creation and modification activities

How to Mitigate CVE-2024-0413

Immediate Actions Required

• Remove or rename the public/install.php file immediately if the application has been fully installed
• Restrict access to installation scripts at the web server level using IP-based access controls
• Review access logs for any suspicious activity targeting the installation endpoint
• Audit administrative accounts for unauthorized additions or modifications
• Place the application behind a reverse proxy with strict access control rules

Patch Information

At the time of publication, no official vendor patch has been documented. Organizations using DeShang DSKMS should contact the vendor (CSDeshang) directly for security updates and monitor for official advisories. Until a patch is available, implementing the workarounds below is strongly recommended.

Workarounds

• Delete or rename the public/install.php file after completing the initial installation
• Use .htaccess or equivalent web server configuration to deny access to installation scripts
• Implement network-level restrictions to limit access to the DSKMS installation from trusted IP addresses only
• Consider placing the application behind a VPN or internal network if public access is not required

# Apache configuration to block access to install.php
<Files "install.php">
    Order Allow,Deny
    Deny from all
</Files>

# Nginx configuration to block access to install.php
location ~ /install\.php$ {
    deny all;
    return 403;
}