CVE-2024-1621: Nt-ware Uniflow Online Auth Bypass Flaw

CVE-2024-1621 Overview

CVE-2024-1621 affects the registration process of uniFLOW Online apps from NT-ware, a Canon subsidiary. The flaw exists in versions up to and including 2024.1.0 when email login is enabled on the tenant. Tenants combining email login with Microsoft Safe Links or similar URL rewriting services are exposed. An attacker can register their own device against a legitimate user account, gaining the same application access and capabilities as the genuine user. The weakness is classified under [CWE-940: Improper Verification of Source of a Communication Channel].

Critical Impact
Attackers can hijack the device registration flow to bind their own client to a victim's account, inheriting the victim's print, scan, and document access privileges.

Affected Products

NT-ware uniFLOW Online (including Chrome variant) up to and including version 2024.1.0
NT-ware uniFLOW Online Print & Scan for Android and iOS
NT-ware uniFLOW SmartClient for Windows and macOS

Discovery Timeline

2024-09-02 - CVE-2024-1621 published to NVD
2024-09-17 - Last updated in NVD database

Technical Details for CVE-2024-1621

Vulnerability Analysis

The vulnerability resides in the device registration workflow of uniFLOW Online apps. When a tenant enables email-based login, the registration process delivers a confirmation link to the user's mailbox. Security gateways such as Microsoft Safe Links rewrite and pre-fetch URLs in inbound email to scan for malicious content. This pre-fetch action interacts with the uniFLOW registration link in a way that allows an attacker who initiates registration to complete it against another user's account. The result is a binding of an attacker-controlled client to a legitimate identity within the tenant.

Root Cause

The root cause is improper verification of the source of the registration confirmation channel. The application treats a single URL fetch as sufficient proof that the legitimate user clicked the registration link. URL rewriting and pre-fetch behaviors from email security products invalidate that assumption, breaking the trust model the registration flow depends on.

Attack Vector

The attack is performed over the network with no authentication required. An attacker initiates a registration request targeting a victim's email address on a tenant that uses email login. When the victim's mail security solution pre-fetches the confirmation URL during scanning, the attacker's registration request is approved. The attacker's device is then enrolled against the victim's account, granting equivalent application access. The vulnerability described above does not have a public proof of concept and is described in prose based on the NT-ware Security Advisory and the Canon Europe PSIRT Advisory.

Detection Methods for CVE-2024-1621

Indicators of Compromise

Device registration events in uniFLOW Online audit logs that do not correlate with user-initiated activity or known device inventory.
Multiple successful registrations against the same user identity originating from different IP addresses or geolocations within a short timeframe.
Registration confirmation URLs accessed by mail-scanning infrastructure (User-Agent strings or IP ranges associated with Microsoft Safe Links or similar services) immediately before unexpected device bindings.

Detection Strategies

Review uniFLOW Online tenant administration logs for device registrations and cross-reference each registration against user-reported activity.
Correlate email security gateway URL pre-fetch logs with uniFLOW registration timestamps to surface anomalous link activations.
Hunt for new device entries bound to privileged or executive accounts that were not provisioned through the standard onboarding process.

Monitoring Recommendations

Enable verbose audit logging on the uniFLOW Online tenant and forward registration events to a centralized SIEM for retention and alerting.
Alert on any device registration occurring outside of business hours or from unexpected source networks.
Periodically reconcile the registered device inventory against the authoritative endpoint and mobile device management inventory.

How to Mitigate CVE-2024-1621

Immediate Actions Required

Upgrade uniFLOW Online apps to a version released after 2024.1.0 that addresses the registration flow weakness, per the NT-ware advisory.
If immediate upgrade is not possible, disable email login on the tenant and require an alternative authentication method such as identity provider federation.
Audit existing device registrations and revoke any bindings that cannot be attributed to a legitimate user action.

Patch Information

NT-ware has published guidance and a fix in the 2024 Security Advisory: Device registration susceptible to compromise. Canon customers should also consult the Canon Europe PSIRT advisory page for product-specific update instructions covering uniFLOW Online, uniFLOW Online Print & Scan, and uniFLOW SmartClient.

Workarounds

Disable email login as the registration confirmation channel until all clients are updated.
Exclude uniFLOW Online registration domains from Microsoft Safe Links URL rewriting and pre-fetch policies, following the configuration steps in the vendor advisory.
Enforce administrator approval for all new device registrations on the tenant where supported.

bash

# Configuration example: exclude uniFLOW registration URLs from Safe Links pre-fetch
# Refer to the NT-ware advisory for the authoritative domain list before applying.
New-SafeLinksPolicy -Name "uniFLOW-Registration-Bypass" \
  -DoNotRewriteUrls "*.uniflowonline.com/registration/*" \
  -ScanUrls $false \
  -EnableForInternalSenders $false