CVE-2024-12917: Health4All Auth Bypass Vulnerability

CVE-2024-12917 Overview

CVE-2024-12917 is a broken access control vulnerability affecting Agito Computer Health4All, a healthcare software product. The flaw exposes files or directories to external parties due to incorrectly configured access control security levels [CWE-552]. Authenticated attackers with low privileges can abuse authentication weaknesses to access resources that should be restricted. The issue affects all Health4All versions released before 10.01.2025. The vulnerability was disclosed through the Turkish National Cyber Incident Response Center (USOM) under advisory TR-25-0042.

Critical Impact
Attackers with low-level authenticated access can read and modify sensitive healthcare files, compromising patient data confidentiality and integrity over the network.

Affected Products

Agito Computer Health4All (all versions prior to 10.01.2025)
Healthcare deployments running vulnerable Health4All releases
Network-exposed Health4All instances with authenticated user access

Discovery Timeline

2025-02-24 - CVE-2024-12917 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12917

Vulnerability Analysis

CVE-2024-12917 stems from files and directories being accessible to external parties within the Health4All application. The vulnerability is classified under [CWE-552: Files or Directories Accessible to External Parties]. Attackers exploit incorrectly configured access control security levels combined with authentication abuse to reach protected resources.

Exploitation requires network access and low-privilege authentication. No user interaction is required. Successful exploitation can result in unauthorized disclosure of protected health information, tampering with stored records, and limited availability impact on application services. Because Health4All is deployed in healthcare environments, exposed files may contain regulated patient data subject to healthcare privacy requirements.

Root Cause

The root cause is a misconfigured access control model that fails to enforce authorization checks on file and directory resources. Security levels tied to authenticated sessions are not correctly evaluated before granting access. The application trusts authenticated identities to reach content that should require additional authorization, allowing authentication abuse to escalate resource visibility.

Attack Vector

The attack is executed over the network by an authenticated user with low privileges. The attacker sends requests targeting file or directory endpoints that lack correct access-level enforcement. Because the flaw resides in server-side access control logic, standard HTTP tooling is sufficient to reach the exposed resources once credentials are obtained. No specialized exploit code has been published. Refer to the USOM Notification TR-25-0042 and Siber Güvenlik Notification TR-25-0042 for advisory details.

Detection Methods for CVE-2024-12917

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting file, directory, or document-download endpoints within Health4All.
Access log entries showing successful retrieval of records outside the requesting user's assigned scope or department.
Repeated enumeration patterns against sequential resource identifiers or directory paths.

Detection Strategies

Correlate authenticated session activity with the roles and departments assigned to each account to flag out-of-scope access.
Baseline normal file and directory access patterns per user role and alert on statistical deviations.
Inspect web server and application logs for high volumes of 200 OK responses to resource endpoints from a single low-privilege session.

Monitoring Recommendations

Forward Health4All application and web server logs to a centralized SIEM for continuous review.
Monitor privileged and low-privileged account activity for lateral movement across patient record repositories.
Track authentication events and file-access events in the same query view to identify authentication abuse patterns.

How to Mitigate CVE-2024-12917

Immediate Actions Required

Upgrade Health4All to the release dated 10.01.2025 or later, which addresses the access control flaw.
Audit user accounts and revoke unnecessary privileges on any Health4All instance still running a vulnerable version.
Restrict network access to Health4All to trusted management networks and clinical segments only.
Rotate credentials for any account suspected of misuse and review recent file access history.

Patch Information

Agito Computer resolved the vulnerability in Health4All versions released on or after 10.01.2025. Administrators should confirm the deployed build against vendor documentation. Reference the Siber Güvenlik Notification TR-25-0042 for the vendor coordination record published by Turkish authorities.

Workarounds

Place Health4All behind a reverse proxy or web application firewall that enforces path-based access rules aligned with user roles.
Disable or restrict any non-essential file-download or directory-browsing features until the patch is applied.
Enforce multi-factor authentication to raise the cost of credential abuse required to reach the vulnerable endpoints.

bash

# Example: restrict access to sensitive Health4All paths at the reverse proxy
location /health4all/files/ {
    allow 10.0.0.0/8;
    deny all;
    auth_request /auth/verify-role;
}