CVE-2024-23747: ModernaNet HMS Information Disclosure

CVE-2024-23747 Overview

CVE-2024-23747 is an Insecure Direct Object Reference (IDOR) vulnerability in the Moderna Sistemas ModernaNet Hospital Management System 2024. The flaw exists in the application's handling of the id parameter within the /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this parameter, an unauthenticated attacker can retrieve medical records belonging to other patients. The vulnerability is classified under [CWE-639: Authorization Bypass Through User-Controlled Key]. The issue affects confidentiality of protected health information and requires no authentication, user interaction, or specialized tooling to exploit.

Critical Impact
A remote, unauthenticated attacker can enumerate patient Laudo (medical report) identifiers over HTTP and exfiltrate sensitive medical records from the hospital management platform.

Affected Products

Moderna Sistemas ModernaNet Hospital Management System 2024
Web interface endpoint /Modernanet/LAUDO/LAU0000100/Laudo
All deployments exposing the Laudo?id= parameter without server-side authorization checks

Discovery Timeline

2024-01-29 - CVE-2024-23747 published to the National Vulnerability Database (NVD)
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-23747

Vulnerability Analysis

The ModernaNet Hospital Management System exposes medical report objects through a predictable URI pattern. Each Laudo (clinical report) is referenced by an integer identifier passed in the id query parameter. The server retrieves and returns the requested report without verifying whether the calling session is authorized to view the underlying patient record.

This is a textbook IDOR pattern. Authorization decisions rely on client-supplied object identifiers rather than session-bound access policies. An attacker iterating through id values can harvest reports across the entire patient population, including diagnostic data, examination results, and provider notes.

The attack vector is network-based with low complexity and no privileges required. The vulnerability impacts confidentiality only; integrity and availability are not affected.

Root Cause

The root cause is missing object-level authorization on the Laudo retrieval handler. The application trusts the id parameter as a sufficient access token and omits the check that ties the requested report to the authenticated user's permission scope.

Attack Vector

An attacker sends crafted HTTP GET requests to /Modernanet/LAUDO/LAU0000100/Laudo?id=<n>, incrementing n to enumerate every medical report stored by the platform. No credentials, tokens, or user interaction are required. Responses contain the protected clinical data in the application's normal rendering format. Public proof-of-concept material is referenced from the GitHub PoC for CVE-2024-23747.

The vulnerability is described in prose only; no verified exploit code is reproduced here.

Detection Methods for CVE-2024-23747

Indicators of Compromise

Sequential or rapid HTTP GET requests to /Modernanet/LAUDO/LAU0000100/Laudo?id= with iterating numeric values
High volume of 2xx responses to Laudo?id= requests originating from a single source IP or user agent
Access to Laudo identifiers that fall outside the requesting account's normal patient assignment
Web server logs showing Laudo?id= access without a corresponding authenticated session cookie

Detection Strategies

Deploy a web application firewall (WAF) rule that alerts on enumeration patterns against the Laudo?id= endpoint
Correlate application audit logs with session identifiers to flag cross-tenant or cross-patient object access
Baseline normal Laudo access volume per user and alert on statistical deviations
Add server-side instrumentation that records the requesting principal alongside every id lookup for later forensic review

Monitoring Recommendations

Ingest ModernaNet web server and application logs into a centralized analytics platform for query and retention
Monitor outbound data volume from the application tier for spikes consistent with bulk record exfiltration
Track failed and successful authorization events on medical record endpoints and alert on unauthenticated successes
Review access patterns weekly until a patched build is confirmed deployed

How to Mitigate CVE-2024-23747

Immediate Actions Required

Restrict network exposure of the ModernaNet application to trusted networks or VPN-only access until a vendor fix is available
Enforce session-bound authorization at the reverse proxy or API gateway in front of /Modernanet/LAUDO/ routes
Rotate any session tokens and review access logs for unauthorized retrieval of Laudo records
Contact Moderna Sistemas through their vendor portal for remediation guidance

Patch Information

No vendor patch or advisory is referenced in the NVD record for CVE-2024-23747 at the time of publication. Operators should engage Moderna Sistemas directly to obtain a fixed build and confirm that object-level authorization checks have been added to the Laudo handler.

Workarounds

Place the application behind an authenticating reverse proxy that validates the requesting user's entitlement to each id value before forwarding the request
Implement WAF rules that block unauthenticated access to /Modernanet/LAUDO/LAU0000100/Laudo and rate-limit id enumeration
Replace numeric Laudo identifiers with unguessable values such as UUIDs in the upstream database mapping, where supported
Disable the affected module if the Laudo reporting functionality is not in active clinical use

bash

# Example NGINX rule to block unauthenticated Laudo access and rate-limit enumeration
limit_req_zone $binary_remote_addr zone=laudo:10m rate=5r/m;

location /Modernanet/LAUDO/ {
    limit_req zone=laudo burst=5 nodelay;
    if ($http_cookie !~* "SessionId=") {
        return 401;
    }
    proxy_pass http://modernanet_backend;
}