CVE-2024-3305 Overview
CVE-2024-3305 is an authorization bypass vulnerability in Utarit Information's SoliClub mobile application. The flaw stems from a user-controlled key in API requests, allowing attackers to retrieve embedded sensitive data belonging to other users. The vulnerability is classified under CWE-639, Authorization Bypass Through User-Controlled Key, and represents a classic Insecure Direct Object Reference (IDOR) flaw. The issue affects SoliClub versions prior to 4.4.0 on iOS and prior to 5.2.1 on Android. Remote unauthenticated attackers can exploit the weakness over the network without user interaction.
Critical Impact
Remote attackers can bypass authorization controls to retrieve sensitive user data embedded in the SoliClub application without authentication or user interaction.
Affected Products
- Utarit Information SoliClub for iOS — versions prior to 4.4.0
- Utarit Information SoliClub for Android — versions prior to 5.2.1
Discovery Timeline
- 2024-09-12 - CVE-2024-3305 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3305
Vulnerability Analysis
The vulnerability resides in how the SoliClub mobile application handles object references when accessing user-scoped resources. The application accepts identifiers supplied by the client and uses them to look up data without verifying that the requesting account owns or is authorized to access that resource. An attacker who modifies a key, identifier, or token in an outbound API request can therefore retrieve records belonging to other users. Because the affected functionality is exposed over the network without authentication and requires no user interaction, exploitation can be automated and performed at scale.
Root Cause
The root cause is a missing server-side authorization check, mapped to CWE-639. Backend API endpoints serving the SoliClub mobile clients trust client-supplied identifiers to determine which records to return. The application does not bind responses to the authenticated session, resulting in horizontal privilege escalation across user accounts.
Attack Vector
Exploitation occurs over the network against the SoliClub backend APIs consumed by the iOS and Android clients. An attacker intercepts requests with a proxy, enumerates or guesses object identifiers, and replays modified requests. The server returns sensitive embedded data tied to the supplied identifier rather than the caller's identity. No credentials, privileges, or user interaction are required, according to the published CVSS vector.
No public proof-of-concept exploit code is available for this issue. Technical details remain limited to the advisories published by the Turkish national CERT.
Detection Methods for CVE-2024-3305
Indicators of Compromise
- High volumes of API requests from a single source iterating sequential or randomized object identifiers against SoliClub backend endpoints.
- Successful HTTP 200 responses returning user data where the requested identifier does not match the session's authenticated user.
- Repeated requests to the same endpoint with varying path parameters or query keys originating from non-mobile user agents.
Detection Strategies
- Inspect backend access logs for patterns indicating identifier enumeration, including monotonic increments and abnormal request rates per session.
- Correlate authenticated session identifiers with the resource identifiers requested to flag mismatches that indicate cross-account access.
- Deploy runtime API monitoring rules that alert when a single account retrieves data scoped to many distinct user identifiers within a short window.
Monitoring Recommendations
- Forward SoliClub API gateway and application logs to a centralized analytics platform for cross-session correlation.
- Track per-endpoint baselines for request volume, identifier diversity, and response size to surface enumeration behavior.
- Alert on outbound traffic from corporate devices to known SoliClub API hosts that deviates from typical mobile client patterns.
How to Mitigate CVE-2024-3305
Immediate Actions Required
- Update SoliClub for iOS to version 4.4.0 or later through the App Store.
- Update SoliClub for Android to version 5.2.1 or later through Google Play.
- Inventory enterprise-managed mobile devices and enforce minimum version policies via mobile device management.
- Review the Turkish Cybersecurity Notification and USOM Security Bulletin for vendor guidance.
Patch Information
Utarit Information has addressed CVE-2024-3305 in SoliClub 4.4.0 for iOS and 5.2.1 for Android. Users must upgrade through the official application stores. No vendor advisory URL is published beyond the Turkish national CERT bulletins listed in the references.
Workarounds
- Restrict use of vulnerable SoliClub versions on corporate devices through mobile application management policies until patched builds are installed.
- Where feasible, block network access from managed devices to SoliClub backend endpoints until clients are updated.
- Advise users to avoid storing sensitive personal information within the application until the upgrade is confirmed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
