CVE-2024-13040 Overview
QOCA aim from Quanta Computer contains an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639]. Authenticated attackers with regular privileges can manipulate the user ID parameter to access features as any other user. The flaw enables modification of any user's account information and privileges, resulting in privilege escalation to administrative roles. The issue was disclosed through TW-CERT and affects deployments of the QOCA aim medical imaging platform.
Critical Impact
A low-privileged remote attacker can tamper with a user identifier in application requests to impersonate other users, alter account privileges, and escalate to administrative access.
Affected Products
- Quanta Computer QOCA aim
Discovery Timeline
- 2024-12-31 - CVE-2024-13040 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13040
Vulnerability Analysis
The vulnerability is an Insecure Direct Object Reference (IDOR) classified under [CWE-639]. QOCA aim relies on a client-supplied user identifier when returning or modifying user records. The server processes this identifier without validating whether the authenticated session owns the referenced account. Any authenticated user can therefore substitute another user's ID and receive that user's data or execute privileged actions against it.
The attack requires only network access and a valid low-privilege account. No user interaction is required, and successful exploitation compromises confidentiality, integrity, and availability of every account in the system.
Root Cause
The application authorizes requests based on session authentication alone. It does not verify that the authenticated principal is entitled to act on the user object referenced by the request parameter. This missing object-level authorization check allows the user ID field to function as a user-controlled key.
Attack Vector
An attacker authenticates with a standard account and issues API requests that reference another user's identifier in a query string, path segment, or request body. The server returns or updates that user's record. By targeting administrator identifiers, the attacker can grant themselves elevated privileges or alter administrative credentials, achieving full application takeover.
No verified exploit code is publicly available. Consult the TW-CERT Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2024-13040
Indicators of Compromise
- Application requests where the authenticated session's user ID does not match the user ID parameter in the request body, URL, or query string.
- Unexpected changes to user roles, permissions, email addresses, or passwords in QOCA aim audit logs.
- Sudden appearance of administrative privileges on accounts that were provisioned as standard users.
Detection Strategies
- Correlate authenticated session identity with the target user ID on every user-management API call and alert on mismatches.
- Baseline normal per-user API access patterns and flag accounts that begin enumerating sequential user IDs.
- Review web server and application logs for high-volume requests to user profile or privilege endpoints from a single low-privileged account.
Monitoring Recommendations
- Enable verbose audit logging for all account modification endpoints in QOCA aim and forward logs to a central SIEM.
- Alert on privilege changes that occur outside of established administrative workflows or change windows.
- Monitor for lateral access patterns where one account reads or modifies many distinct user records in a short interval.
How to Mitigate CVE-2024-13040
Immediate Actions Required
- Contact Quanta Computer support to obtain the fixed release of QOCA aim and apply it to all deployments.
- Restrict network exposure of the QOCA aim application to trusted clinical networks and VPN users only.
- Audit all user accounts for unauthorized privilege changes and reset credentials for any suspected compromised accounts.
Patch Information
Refer to the TW-CERT Security Advisory and the TW-CERT Security Alert for the vendor-supplied fixed version and upgrade instructions. Apply the vendor patch as soon as it is available in your environment.
Workarounds
- Place the QOCA aim application behind a reverse proxy or web application firewall that inspects and blocks requests where the session user does not match the target user ID.
- Limit application access to a minimal set of authenticated users while the patch is being validated and deployed.
- Increase audit-log retention and review frequency to detect exploitation attempts prior to patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
