CVE-2024-0580: Idmsistemas Sinergia Info Disclosure Flaw

CVE-2024-0580 Overview

CVE-2024-0580 is an authorization flaw in the IDMSistemas Sinergia platform that affects the QSige product. The vulnerability stems from an omission of user-controlled key authorization, classified as [CWE-639] Authorization Bypass Through User-Controlled Key. Attackers can extract sensitive information from the API by manipulating the center identifier in requests to /qsige.locator/quotePrevious/centers/X, where X accepts sequential values such as 1, 2, 3, and so on. The flaw requires no authentication and can be exploited remotely over the network.

Critical Impact
Unauthenticated attackers can enumerate center identifiers and retrieve sensitive data from the QSige API without any user interaction.

Affected Products

IDMSistemas Sinergia 2.0
IDMSistemas QSige (component within Sinergia)
Deployments exposing /qsige.locator/quotePrevious/centers/ endpoints

Discovery Timeline

2024-01-18 - CVE-2024-0580 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0580

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the QSige locator API. The application accepts a numeric center identifier in the URL path but fails to verify whether the requesting user has authorization to access the referenced center. By incrementing the identifier value, an attacker can iterate through every center registered in the platform and harvest information that should be restricted by tenant or role.

The endpoint /qsige.locator/quotePrevious/centers/X returns data tied to each center identifier. Because the authorization check is missing, the server treats any caller as legitimate for any center. The CWE-639 classification confirms the root issue: the authorization decision relies on a user-controlled key without server-side validation of ownership or entitlement.

Root Cause

The application omits an authorization check between the authenticated session context and the requested resource identifier. The backend logic resolves the center referenced by the path parameter and returns its associated quote data without confirming that the caller belongs to that center or holds a role permitting the read.

Attack Vector

Exploitation requires only HTTP access to the exposed QSige API. An attacker sends sequential GET requests to /qsige.locator/quotePrevious/centers/1, /qsige.locator/quotePrevious/centers/2, and so on. Each response discloses data belonging to a different center. No credentials, tokens, or user interaction are required.

No verified public exploit code is available. For technical specifics, see the INCIBE Security Notice.

Detection Methods for CVE-2024-0580

Indicators of Compromise

Sequential or enumerative GET requests to /qsige.locator/quotePrevious/centers/ with incrementing integer parameters from a single source IP.
Unusually high request volume against the QSige locator API outside normal business hours.
Successful HTTP 200 responses returning center data to clients that have never authenticated against the platform.

Detection Strategies

Inspect web server and reverse proxy logs for repeated access patterns against /qsige.locator/quotePrevious/centers/{id} with varying numeric IDs.
Configure a Web Application Firewall (WAF) rule to alert on rapid identifier enumeration on the affected URI pattern.
Correlate API access logs with session identifiers to detect requests that traverse multiple center IDs from a single client.

Monitoring Recommendations

Forward QSige application and proxy logs to a centralized analytics platform for sustained review of API access patterns.
Track rate-of-change metrics on the centers/{id} endpoint and trigger alerts on enumeration thresholds.
Baseline normal client behavior per center and flag deviations where a single client accesses multiple centers in a short window.

How to Mitigate CVE-2024-0580

Immediate Actions Required

Restrict network access to the QSige API to trusted clients via firewall or VPN until a vendor fix is applied.
Apply WAF rules to block or rate-limit access to /qsige.locator/quotePrevious/centers/ from unauthenticated sources.
Audit historical access logs to identify prior enumeration attempts and assess potential data exposure.

Patch Information

No vendor patch advisory is referenced in the available CVE data. Administrators should consult IDMSistemas directly and monitor the INCIBE Security Notice for remediation guidance specific to QSige.

Workarounds

Place the QSige API behind an authenticating reverse proxy that enforces per-user authorization before forwarding requests.
Implement server-side checks that bind the requesting session to the allowed center identifier and reject mismatched requests.
Replace sequential numeric identifiers with non-guessable opaque tokens to slow enumeration while authorization fixes are deployed.

bash

# Example WAF rule (ModSecurity) to block enumeration on the vulnerable endpoint
SecRule REQUEST_URI "@rx ^/qsige\.locator/quotePrevious/centers/[0-9]+$" \
    "id:1002401,phase:1,deny,status:403,\
     msg:'Block unauthenticated access to QSige centers endpoint (CVE-2024-0580)',\
     chain"
    SecRule &REQUEST_HEADERS:Authorization "@eq 0"