CVE-2024-10381: Cosec Vega FAXQ Auth Bypass Vulnerability

CVE-2024-10381 Overview

This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable device.

Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access and take complete control of the targeted device, posing significant risks to physical security infrastructure.

Critical Impact

Remote attackers can bypass authentication and gain complete control of door access control systems, potentially compromising physical security of protected facilities.

Affected Products

• Matrix Cosec Vega FAXQ Firmware (all versions)
• Matrix Cosec Vega FAXQ Hardware Device
• Matrix Door Controller Web Management Interface

Discovery Timeline

• October 25, 2024 - CVE-2024-10381 published to NVD
• November 14, 2024 - Last updated in NVD database

Technical Details for CVE-2024-10381

Vulnerability Analysis

This vulnerability stems from Authentication Bypass Using an Alternate Path or Channel (CWE-288) within the Matrix Door Controller Cosec Vega FAXQ web-based management interface. The improper session management implementation allows attackers to circumvent normal authentication procedures entirely.

Physical access control systems like the Cosec Vega FAXQ are critical security infrastructure components designed to regulate entry to protected areas. When session management is improperly implemented, the fundamental security model of the device becomes compromised, allowing unauthorized parties to manipulate door access policies, view access logs, and potentially grant physical access to restricted areas.

The vulnerability is network-accessible with low attack complexity, requiring no privileges or user interaction to exploit. This makes it particularly dangerous in environments where the device's web interface is accessible from broader network segments or, in worst-case scenarios, the internet.

Root Cause

The root cause lies in the improper implementation of session management within the web-based management interface. The device fails to properly validate session tokens or implement adequate authentication controls, creating an alternate path that allows attackers to bypass normal authentication mechanisms. This deficiency permits unauthenticated requests to be processed as if they originated from legitimate administrative sessions.

Attack Vector

The attack is executed remotely over the network through the device's web management interface. An attacker can craft malicious HTTP requests that exploit the session management weakness to gain unauthorized access to the device's administrative functions. Once successful, the attacker obtains complete control over the door controller, enabling them to:

• Modify access control policies and permissions
• Add or remove authorized users
• Unlock or lock doors at will
• Access and tamper with audit logs
• Potentially use the compromised device as a pivot point for further network attacks

The attack requires no authentication credentials and can be performed by any network-accessible adversary with knowledge of the vulnerability.

Detection Methods for CVE-2024-10381

Indicators of Compromise

• Unexpected administrative sessions or login events on Cosec Vega FAXQ devices without corresponding legitimate administrator activity
• Anomalous HTTP requests to the web management interface, particularly requests with malformed or missing session tokens that still result in successful actions
• Unauthorized changes to door access policies, user permissions, or system configurations
• Unusual network traffic patterns to/from the door controller devices on management ports

Detection Strategies

• Implement network traffic analysis to monitor for unusual HTTP request patterns targeting Cosec Vega FAXQ management interfaces
• Deploy intrusion detection system (IDS) rules to identify authentication bypass attempts against physical access control devices
• Establish baseline behavior for management interface access and alert on deviations
• Monitor for administrative actions that occur without corresponding valid authentication events

Monitoring Recommendations

• Enable comprehensive logging on all Matrix door controller devices and forward logs to a centralized SIEM platform
• Configure alerts for any configuration changes made to door access systems, requiring manual verification of all modifications
• Implement network segmentation monitoring to detect any unauthorized access attempts to the management VLAN
• Regularly audit access control system logs for signs of tampering or unauthorized access

How to Mitigate CVE-2024-10381

Immediate Actions Required

• Isolate affected Matrix Cosec Vega FAXQ devices from untrusted network segments immediately by placing them on a dedicated, restricted management VLAN
• Implement strict firewall rules to limit access to the web management interface to only authorized administrator workstations
• Disable remote web management if not absolutely required, and use local configuration methods where possible
• Conduct a thorough audit of current device configurations and access control policies to identify any unauthorized modifications

Patch Information

Organizations should consult the CERT-IN Vulnerability Note CIVN-2024-0328 for official guidance and contact Matrix Comsec directly for firmware updates or patches that address this vulnerability. Given the critical nature of this vulnerability, applying vendor-provided patches should be treated as a high priority.

Workarounds

• Implement network segmentation to isolate door controller devices on a dedicated, non-routable management network segment accessible only to authorized administrators
• Deploy a VPN or jump host requirement for all administrative access to physical access control systems
• Configure host-based firewall rules or access control lists (ACLs) on network switches to restrict management interface access to specific IP addresses
• Enable additional authentication mechanisms such as client certificate validation if supported by network infrastructure
• Consider implementing a web application firewall (WAF) in front of the management interface to filter malicious requests

# Network isolation configuration example (Cisco IOS-style ACL)
# Restrict access to door controller management interface
access-list 101 permit tcp host 10.10.10.5 host 192.168.100.50 eq 443
access-list 101 permit tcp host 10.10.10.6 host 192.168.100.50 eq 443
access-list 101 deny tcp any host 192.168.100.50 eq 443
access-list 101 deny tcp any host 192.168.100.50 eq 80
# Apply to interface facing door controller segment
interface GigabitEthernet0/1
  ip access-group 101 out