CVE-2024-1255: Sepidzdigitalmenu Information Disclosure

CVE-2024-1255 Overview

CVE-2024-1255 is an information disclosure vulnerability affecting Sepidz SepidzDigitalMenu versions up to 7.1.0728.1. The flaw resides in unknown code within the /Waiters endpoint and allows remote attackers to retrieve sensitive information without authentication. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and has been publicly disclosed, making exploitation feasible without prior coordination. According to the disclosure, the vendor was contacted before publication but did not respond. The identifier VDB-252994 was assigned to track this issue.

Critical Impact
Unauthenticated remote attackers can access sensitive data exposed by the /Waiters endpoint, with no user interaction required.

Affected Products

Sepidz SepidzDigitalMenu versions up to and including 7.1.0728.1
Deployments exposing the /Waiters endpoint to untrusted networks
Restaurant and hospitality environments using the digital menu platform

Discovery Timeline

2024-02-06 - CVE-2024-1255 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1255

Vulnerability Analysis

The vulnerability affects the /Waiters endpoint of SepidzDigitalMenu, a digital menu platform used in hospitality environments. The endpoint exposes sensitive information to unauthenticated remote callers. Because the attack vector is network-based with low complexity and requires no privileges or user interaction, an attacker only needs network reachability to the application to extract data.

The issue maps to [CWE-200], where the application fails to restrict access to information it processes or stores. The specific data exposed has not been documented publicly, but the endpoint name suggests it returns waiter or staff records that should require authentication. Confidentiality impact is high while integrity and availability remain unaffected.

Root Cause

The root cause is missing or improperly enforced access control on the /Waiters endpoint. The application returns sensitive data in response to unauthenticated HTTP requests, indicating that authentication or authorization checks are either absent or bypassable. This is a common pattern in business applications where internal endpoints are inadvertently exposed without session validation.

Attack Vector

An attacker reaches the vulnerable endpoint over the network and issues a standard HTTP request to /Waiters. No credentials, tokens, or user interaction are required. Because the exploit details have been published, automated scanning and opportunistic abuse are feasible against internet-exposed instances. The EPSS score is 0.093% with a percentile of 25.95, indicating low currently observed exploitation activity, but public disclosure raises the practical risk.

No verified proof-of-concept code is available in trusted repositories. Refer to the VulDB entry for VDB-252994 for additional technical context.

Detection Methods for CVE-2024-1255

Indicators of Compromise

Unauthenticated HTTP GET requests to the /Waiters path from external or unexpected internal sources
High-volume or sequential requests to SepidzDigitalMenu endpoints suggesting automated enumeration
Outbound data transfers from the application server following inbound requests to /Waiters

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting /Waiters without an authenticated session cookie or token
Deploy WAF rules that flag access to the /Waiters endpoint from sources outside the expected operational network
Correlate access patterns with known scanner user agents and IP reputation feeds

Monitoring Recommendations

Enable verbose HTTP access logging on systems hosting SepidzDigitalMenu and forward logs to a centralized analytics platform
Alert on responses to /Waiters exceeding a defined size threshold, which may indicate bulk data extraction
Review network egress from the application host for anomalous destinations or volumes after suspicious inbound activity

How to Mitigate CVE-2024-1255

Immediate Actions Required

Restrict network access to SepidzDigitalMenu so that the /Waiters endpoint is not reachable from untrusted networks or the public internet
Place the application behind a reverse proxy or WAF that enforces authentication before requests reach the backend
Audit web server logs for prior unauthenticated access to /Waiters to assess potential data exposure

Patch Information

No vendor patch has been published. The disclosure record notes that the vendor was contacted before publication but did not respond. Organizations should treat this as an unpatched vulnerability and apply compensating controls until a fixed version is released. Monitor the VulDB advisory and vendor channels for updates.

Workarounds

Block external access to the /Waiters URL path at the reverse proxy, load balancer, or web application firewall layer
Require authenticated session validation at an upstream proxy for all SepidzDigitalMenu endpoints
Segment the application onto a management VLAN accessible only to authorized staff workstations
Consider isolating or decommissioning internet-exposed deployments until a vendor fix is available

bash

# Example nginx configuration to block external access to /Waiters
location /Waiters {
    allow 10.0.0.0/8;       # internal management network
    deny all;
    proxy_pass http://sepidz_backend;
}