CVE-2024-32862: ExacqVision Web Service SSRF Vulnerability

CVE-2024-32862 Overview

CVE-2024-32862 affects Johnson Controls ExacqVision Web Service, a component of the exacqVision video management platform. The ExacqVision Web Service fails to provide sufficient protection from untrusted domains under certain circumstances. This permissive cross-domain behavior maps to [CWE-942] (Permissive Cross-domain Policy with Untrusted Domains) and [CWE-697] (Incorrect Comparison). An attacker can leverage the weakness to coerce an authenticated user into interacting with attacker-controlled content, leading to high impact on confidentiality and integrity.

Critical Impact
A remote attacker can abuse permissive cross-domain handling in ExacqVision Web Service to access or modify data in the context of an authenticated user session, with no privileges required and only minimal user interaction.

Affected Products

Johnson Controls ExacqVision Web Service (all versions prior to the fixed release listed in the vendor advisory)
Deployments exposing the ExacqVision Web Service to untrusted networks or browsers
exacqVision systems integrated with web-based clients relying on the affected service

Discovery Timeline

2024-08-01 - CVE-2024-32862 published to the National Vulnerability Database (NVD)
2024-08-01 - CISA ICS Advisory ICSA-24-214-02 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32862

Vulnerability Analysis

The ExacqVision Web Service exposes HTTP endpoints used by browser-based clients to manage and view video surveillance data. The vulnerability stems from insufficient validation of the origin of cross-domain requests. When the service evaluates whether a requesting domain should be trusted, the comparison logic is flawed, classified under [CWE-697]. The result is that requests from domains that should be untrusted are accepted as if they were legitimate.

Because the cross-domain policy is overly permissive ([CWE-942]), an authenticated user who is induced to load attacker-controlled content can have their browser issue cross-origin requests to the ExacqVision Web Service. These requests inherit the user's session context, enabling read and write operations against the video management backend. The attack is network reachable and does not require prior authentication on the attacker side.

Root Cause

The root cause is the combination of a permissive cross-domain configuration and an incorrect domain comparison routine within the ExacqVision Web Service. Origin or referer validation does not strictly enforce an allow-list of trusted domains, so requests originating from arbitrary external domains can be processed.

Attack Vector

Exploitation is remote and browser-mediated. An attacker hosts a malicious page or injects content into a site the victim already trusts. When the authenticated ExacqVision user visits that content, scripted requests are issued cross-origin to the Web Service. The service accepts and processes the requests, exposing video data, configuration, or other resources the user can access.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose; refer to the CISA ICS Advisory ICSA-24-214-02 for vendor-confirmed technical detail.

Detection Methods for CVE-2024-32862

Indicators of Compromise

Web Service access logs showing requests with Origin or Referer headers from domains outside the organization's trusted set.
Unexpected API calls to ExacqVision endpoints occurring while operator browsers are loading third-party or webmail content.
Configuration changes, user enumeration, or video export actions that do not correlate with operator console activity.

Detection Strategies

Inspect HTTP request logs from the ExacqVision Web Service for cross-origin requests and Access-Control-Allow-Origin responses that echo arbitrary domains.
Correlate authenticated session activity with the user's known workstation and browsing context to identify requests triggered by external pages.
Monitor network telemetry from operator workstations for outbound connections to suspicious domains immediately followed by ExacqVision API traffic.

Monitoring Recommendations

Forward ExacqVision Web Service and reverse-proxy logs to a centralized logging or SIEM platform and alert on anomalous Origin and Referer values.
Track failed and successful authentication events on ExacqVision and pair them with browser user-agent and source IP for baseline deviation.
Periodically review CORS response headers returned by the ExacqVision Web Service to confirm they match the patched, restrictive policy.

How to Mitigate CVE-2024-32862

Immediate Actions Required

Apply the fixed ExacqVision Web Service version identified in the Johnson Controls Security Advisory.
Restrict network access to the ExacqVision Web Service so that only trusted management networks can reach it.
Require operators to use dedicated browsers or workstations for video management, isolated from general web browsing and email.

Patch Information

Johnson Controls has published remediation guidance through its trust center. Refer to the Johnson Controls Security Advisory and CISA ICS Advisory ICSA-24-214-02 for the specific fixed version and upgrade procedures for affected ExacqVision deployments.

Workarounds

Place the ExacqVision Web Service behind a reverse proxy that enforces a strict allow-list of trusted origins and rejects requests with unknown Origin or Referer values.
Segment the video management network and block direct internet access to and from systems hosting the ExacqVision Web Service.
Educate operators to avoid browsing untrusted sites or opening untrusted links while authenticated to ExacqVision, until patching is complete.

bash

# Example reverse-proxy origin allow-list (nginx)
map $http_origin $cors_ok {
    default 0;
    "https://exacq.internal.example.com" 1;
}

server {
    listen 443 ssl;
    server_name exacq.internal.example.com;

    location / {
        if ($cors_ok = 0) { return 403; }
        proxy_pass http://exacqvision-web-service:80;
    }
}