CVE-2024-3306: Utarit Soliclub Auth Bypass Vulnerability

CVE-2024-3306 Overview

CVE-2024-3306 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in Utarit Information SoliClub. The flaw allows attackers to exploit incorrectly configured access control security levels in the mobile application. SoliClub versions before 4.4.0 for iOS and before 5.2.1 for Android are affected. A remote attacker can manipulate user-controlled identifiers in requests to access resources belonging to other users without authentication. The vulnerability impacts confidentiality of user data within the SoliClub platform.

Critical Impact
Unauthenticated remote attackers can bypass access controls by manipulating object references, exposing sensitive user data across the SoliClub mobile platform.

Affected Products

Utarit Information SoliClub for iOS versions before 4.4.0
Utarit Information SoliClub for Android versions before 5.2.1
All deployments using vulnerable SoliClub mobile clients

Discovery Timeline

2024-09-12 - CVE-2024-3306 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3306

Vulnerability Analysis

The vulnerability falls under CWE-639: Authorization Bypass Through User-Controlled Key. SoliClub uses identifiers supplied by the client to retrieve resources without verifying that the requesting user owns or has permission to access the target object. This pattern is commonly referred to as an Insecure Direct Object Reference (IDOR). An attacker who knows or guesses a valid resource identifier can substitute it into API requests to access another user's records. The flaw resides in server-side authorization logic exposed to the mobile clients, so updating the mobile app version enforces the corrected access checks.

Root Cause

The root cause is missing or improperly configured object-level authorization in the SoliClub backend API. The application trusts client-supplied keys, such as user IDs or record identifiers, without confirming the session principal has rights to the referenced object. Access control checks are absent or bypassable at the security level tier consumed by the mobile clients.

Attack Vector

An attacker uses the SoliClub mobile application or a proxied HTTP client to issue API requests over the network. The attacker substitutes another user's identifier into a request parameter and receives data they are not authorized to see. No authentication, user interaction, or local access is required, which expands the attack surface to any internet-connected adversary. Refer to the Siber Güvenlik Advisory TR-24-1457 and the USOM Notification TR-24-1457 for vendor-coordinated details.

No verified proof-of-concept code is publicly available. The exploitation pattern follows standard IDOR techniques: enumerate or guess object identifiers and replay authenticated or unauthenticated API requests substituting target keys.

Detection Methods for CVE-2024-3306

Indicators of Compromise

Spikes in API requests against SoliClub endpoints with sequentially enumerated identifier parameters
HTTP 200 responses to requests that reference identifiers not associated with the authenticated session
Unusual data egress volumes from SoliClub backend services tied to a single client IP or device
Mobile clients reporting versions below 4.4.0 (iOS) or 5.2.1 (Android) in user-agent or telemetry

Detection Strategies

Inspect application logs for repeated access to records using identifier values that increment or follow a predictable pattern
Correlate the authenticated user ID with the resource owner ID on every API call and alert on mismatches
Deploy Web Application Firewall (WAF) rules that flag parameter tampering and broken object-level authorization patterns
Monitor for high-frequency requests from a single token enumerating different userId or resource ID values

Monitoring Recommendations

Forward SoliClub API gateway logs to a centralized SIEM and build identifications for IDOR patterns
Track installed mobile app versions in mobile device management (MDM) inventory to identify vulnerable clients
Establish baselines for normal per-user request rates and alert on deviations consistent with enumeration

How to Mitigate CVE-2024-3306

Immediate Actions Required

Update SoliClub for iOS to version 4.4.0 or later and SoliClub for Android to version 5.2.1 or later
Force re-authentication of all sessions and rotate API tokens after upgrading
Audit backend logs for the past several months to identify possible exploitation prior to patching
Restrict API access to known mobile app versions through version gating at the API gateway

Patch Information

Utarit Information has released fixed versions of the SoliClub mobile application. Administrators must ensure end users install SoliClub 4.4.0 or newer on iOS and 5.2.1 or newer on Android. Backend authorization logic should be confirmed updated in line with the vendor advisory referenced in USOM Notification TR-24-1457.

Workarounds

Enforce server-side authorization checks that verify the session principal owns every requested object
Use opaque, non-sequential identifiers such as UUIDs to make enumeration impractical
Apply rate limiting and anomaly detection on endpoints that accept user-controlled identifiers
Block outdated SoliClub client versions at the API gateway until users upgrade

bash

# Example API gateway rule to block vulnerable SoliClub client versions
if ($http_user_agent ~* "SoliClub/(([0-3]\.)|(4\.[0-3]\.)|(5\.[01]\.[0-9]+ Android))") {
    return 426 "Upgrade Required: install SoliClub 4.4.0+ (iOS) or 5.2.1+ (Android)";
}