CVE-2024-0912: C-CURE 9000 Information Disclosure Flaw

CVE-2024-0912 Overview

CVE-2024-0912 is a high-severity information disclosure vulnerability affecting the Johnson Controls C•CURE 9000 Web Server. Under certain circumstances, the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. This sensitive data exposure could allow attackers with local access to harvest credentials and potentially escalate privileges or move laterally within the network.

The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), indicating that the application writes sensitive authentication data to log files that may be accessible to unauthorized parties. There is no impact to non-web service interfaces for C•CURE 9000 or prior versions.

Critical Impact

Windows credentials logged in plaintext within IIS logs could enable credential theft, privilege escalation, and lateral movement in enterprise environments using C•CURE 9000 physical access control systems.

Affected Products

• Johnson Controls Software House C•CURE 9000 SiteServer version 3.00.2
• C•CURE 9000 Web Server components hosted on Microsoft IIS
• Environments using Windows authentication with C•CURE 9000 Web Server

Discovery Timeline

• June 6, 2024 - CVE-2024-0912 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-0912

Vulnerability Analysis

This vulnerability represents a classic information disclosure flaw where sensitive authentication credentials are inadvertently written to log files. The C•CURE 9000 Web Server, when hosted on Microsoft IIS, fails to properly sanitize or exclude Windows credential information from being captured in server logs under certain operational conditions.

The root cause stems from improper handling of authentication data during the logging process. When users authenticate to the C•CURE 9000 Web Server using Windows credentials, the logging mechanism captures more information than necessary, including sensitive credential details that should never be persisted to disk.

Physical access control systems like C•CURE 9000 are critical infrastructure components often deployed in sensitive environments including government facilities, healthcare organizations, and financial institutions. Credential exposure in these contexts poses significant risks to overall security posture.

Root Cause

The vulnerability originates from CWE-532 (Insertion of Sensitive Information into Log File). The IIS logging configuration for the C•CURE 9000 Web Server does not properly filter or mask Windows authentication credentials before writing them to log files. This occurs because the application fails to implement appropriate data sanitization controls in the authentication workflow, allowing credential information to be captured in verbose logging output.

Attack Vector

The attack vector is local, requiring an attacker to have access to the system where the IIS logs are stored. An attacker with local access to the server hosting C•CURE 9000 Web Server could:

1. Access IIS log files stored on the local file system
2. Parse log entries to extract Windows credential information
3. Use harvested credentials for authentication to other systems
4. Escalate privileges within the domain if administrative credentials are captured
5. Move laterally through the network using compromised credentials

The exploitation does not require network-based attacks but does require privileged local access and user interaction to trigger the logging condition. This limits the attack surface but does not diminish the severity when credentials of high-privilege users are exposed.

Detection Methods for CVE-2024-0912

Indicators of Compromise

• Unusual access patterns to IIS log directories (%SystemDrive%\inetpub\logs\LogFiles)
• Log file exfiltration attempts or large-scale log file reads
• Authentication attempts using credentials that were previously only used for C•CURE 9000 access
• Evidence of credential harvesting tools targeting IIS log locations

Detection Strategies

• Monitor file access events on IIS log directories for unauthorized read operations
• Implement file integrity monitoring (FIM) on C•CURE 9000 Web Server log locations
• Audit administrative access to systems hosting C•CURE 9000 Web Server
• Deploy endpoint detection and response (EDR) solutions to identify credential harvesting activities

Monitoring Recommendations

• Enable Windows Security Event logging for file access (Event ID 4663) on IIS log directories
• Configure SIEM alerts for bulk log file access or copying operations
• Review access control lists on IIS log directories to ensure principle of least privilege
• Implement SentinelOne Singularity to monitor for suspicious file access patterns and credential theft techniques

How to Mitigate CVE-2024-0912

Immediate Actions Required

• Review and restrict access permissions to IIS log directories immediately
• Rotate all Windows credentials that may have been logged during the vulnerable period
• Audit IIS log files for exposed credential information and securely delete affected logs
• Implement network segmentation to limit access to systems hosting C•CURE 9000 Web Server

Patch Information

Johnson Controls has issued a security advisory addressing this vulnerability. Administrators should consult the Johnson Controls Security Advisory JCI-PSA-2024-04 for specific patch information and remediation guidance. CISA has also published an Industrial Control Systems advisory with additional details available at CISA ICS Advisory ICSA-24-135-03.

Organizations should prioritize applying vendor-provided patches and follow the recommended upgrade path to address the credential logging issue in the C•CURE 9000 Web Server configuration.

Workarounds

• Restrict file system access to IIS log directories to only essential administrative accounts
• Configure IIS logging to exclude sensitive fields where possible
• Implement log rotation policies to minimize the window of credential exposure
• Consider disabling verbose logging on the C•CURE 9000 Web Server until patches are applied
• Use dedicated service accounts with limited privileges for C•CURE 9000 Web Server authentication

# Restrict IIS log directory permissions (example)
icacls "%SystemDrive%\inetpub\logs\LogFiles" /inheritance:r
icacls "%SystemDrive%\inetpub\logs\LogFiles" /grant:r "SYSTEM:(OI)(CI)F"
icacls "%SystemDrive%\inetpub\logs\LogFiles" /grant:r "Administrators:(OI)(CI)F"