CVE-2024-13110: Yunfan Exam System Information Disclosure

CVE-2024-13110 Overview

CVE-2024-13110 is an information disclosure vulnerability in Beijing Yunfan Internet Technology's Yunfan Learning Examination System version 1.9.2. The flaw resides in the Exam Answer Handler component, specifically within src/main/java/com/yf/exam/modules/paper/controller/PaperController.java. A remote attacker with low privileges can manipulate the affected function to disclose sensitive information without user interaction. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability is tracked under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote authenticated attackers can retrieve sensitive exam-related data through the vulnerable PaperController endpoint, exposing examinee responses and internal paper data.

Affected Products

Kaoshifeng Yunfan Learning Examination System 1.9.2
Beijing Yunfan Internet Technology yfexam-exam application
Deployments exposing the PaperController Exam Answer Handler endpoint

Discovery Timeline

2025-01-02 - CVE-2024-13110 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13110

Vulnerability Analysis

The vulnerability is an information disclosure flaw in the Java Spring-based PaperController class of the Yunfan Learning Examination System. The Exam Answer Handler function inside PaperController.java fails to enforce adequate authorization checks when returning exam paper or answer data to the client. An attacker holding a low-privilege account, such as a standard student user, can invoke the endpoint remotely over the network to retrieve data that should be restricted to instructors or administrators.

Because the application is an online examination platform, the exposed data can include exam questions, answer keys, and submitted responses. Public disclosure of the issue through the project's GitHub Issue Discussion and VulDB #289926 means proof-of-concept techniques are accessible to opportunistic attackers.

Root Cause

The root cause is missing or insufficient access-control validation on a REST endpoint exposed by PaperController.java. The controller method returns paper and answer objects without verifying that the requesting principal owns or is authorized to view the requested resource. This maps to [CWE-200] and represents a classic Insecure Direct Object Reference pattern where object identifiers can be enumerated by any authenticated user.

Attack Vector

Exploitation requires only network access to the application and a low-privilege authenticated session. No user interaction is required, and the attack complexity is low. An attacker sends crafted HTTP requests to the vulnerable Exam Answer Handler route, iterating over paper or answer identifiers to harvest exam content. The vulnerability affects confidentiality only; integrity and availability are not impacted per the published CVSS 4.0 metrics.

No verified public proof-of-concept code is provided in the enriched data. Refer to the GitHub Issue Detail and VulDB #289926 CTI records for the disclosed technical details.

Detection Methods for CVE-2024-13110

Indicators of Compromise

Repeated HTTP requests from a single authenticated session to endpoints served by PaperController with incrementing paper or answer identifiers.
Unusual volumes of successful 200 OK responses returning JSON payloads containing exam answer fields to non-administrative accounts.
Access to Exam Answer Handler routes from IP addresses geographically or behaviorally inconsistent with the associated student account.

Detection Strategies

Enable verbose request logging on the Yunfan application server and alert on access to PaperController routes by users lacking the instructor or admin role.
Deploy a Web Application Firewall (WAF) rule to flag sequential identifier enumeration against paper-related URIs.
Correlate authentication logs with API access logs to identify accounts pulling exam data outside normal scheduled exam windows.

Monitoring Recommendations

Baseline typical per-user request rates against the Exam Answer Handler and alert on statistical deviations.
Monitor for HTTP responses with abnormally large payload sizes originating from the paper controller endpoints.
Forward application logs to a centralized SIEM and retain them for at least 90 days to support retrospective investigation of data exposure.

How to Mitigate CVE-2024-13110

Immediate Actions Required

Restrict network exposure of the Yunfan Learning Examination System to trusted internal networks or VPN-gated access until a vendor fix is available.
Disable or gate the vulnerable Exam Answer Handler endpoint behind stricter role checks at the reverse proxy or API gateway layer.
Rotate exam content and answer keys that may have been exposed on internet-facing deployments.
Audit application access logs for prior enumeration activity against PaperController routes.

Patch Information

No official vendor patch or fixed version is referenced in the available advisory data. Users should monitor the upstream GitHub Issue Discussion for remediation guidance and review the VulDB #289926 entry for updates on remediated releases.

Workarounds

Implement server-side authorization checks in a reverse proxy or API gateway that validates the requester's role before forwarding requests to PaperController endpoints.
Apply strict role-based access control (RBAC) at the application ingress so that only instructor and administrator roles can retrieve full paper and answer objects.
Enforce rate limiting on paper-related API routes to slow identifier enumeration and increase detection likelihood.

bash

# Example NGINX snippet: restrict PaperController access to admin subnet
location ~ ^/exam/paper/ {
    allow 10.0.10.0/24;    # admin/instructor subnet
    deny all;
    proxy_pass http://yunfan_backend;
}

# Example rate limit on paper endpoints
limit_req_zone $binary_remote_addr zone=paperzone:10m rate=10r/m;
location /exam/paper/ {
    limit_req zone=paperzone burst=5 nodelay;
    proxy_pass http://yunfan_backend;
}