CVE-2024-38284: CSRF Replay Attack Vulnerability

CVE-2024-38284 Overview

CVE-2024-38284 describes an authentication weakness in which transmitted data is logged between a device and its backend service. An attacker with access to these logs can replay captured requests to replicate legitimate calls to the backend. The issue is tracked under CWE-294 (Authentication Bypass by Capture-replay) and was published as part of CISA ICS Advisory ICSA-24-165-19. The flaw allows a network-adjacent attacker with low privileges to compromise confidentiality, integrity, and availability of the affected system.

Critical Impact
An attacker who obtains access to transmission logs can replay recorded requests against the backend service, impersonating legitimate device activity and executing calls without fresh authentication.

Affected Products

Products covered under CISA ICS Advisory ICSA-24-165-19
Industrial Control System (ICS) device communicating with a backend service
Backend service accepting logged device requests

Discovery Timeline

2024-06-13 - CVE-2024-38284 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38284

Vulnerability Analysis

The vulnerability stems from the device-to-backend communication channel logging transmitted data in a form that can be reused. Because the protocol does not adequately bind requests to a unique session context, nonce, or timestamp, captured messages remain valid when resubmitted. This exposes the system to capture-replay attacks classified under [CWE-294].

An attacker who can read the stored transmission logs replays the recorded traffic to the backend. The backend accepts the request as if it originated from the legitimate device, executing the associated operation. The impact depends on which calls are replicated, ranging from state changes to data disclosure.

The attack requires network access and low privileges. No user interaction is required, and the attack complexity is low. Because ICS environments often keep devices online for extended periods, replayed calls can persist without triggering ordinary session controls.

Root Cause

The root cause is insufficient replay protection in the authentication or message-integrity layer between the device and backend. Requests lack cryptographic freshness controls, such as short-lived nonces, sequence numbers, or signed timestamps. Sensitive request material is also written to logs, giving attackers a durable source of replayable payloads.

Attack Vector

An attacker gains access to the transmission logs, either through log storage exposure, an authenticated foothold, or a misconfigured logging pipeline. The attacker extracts a valid device request, including any authentication token or signature captured in the log. The attacker then submits the request to the backend service over the network to replicate the original call. See the CISA ICS advisory for vendor-specific technical detail.

No verified proof-of-concept code is available. The vulnerability mechanism is described in prose because SentinelLabs does not publish synthesized exploit code.

Detection Methods for CVE-2024-38284

Indicators of Compromise

Repeated backend requests carrying identical payloads, tokens, or signatures from unexpected source addresses.
Backend transactions that succeed outside the device's normal operating windows or duty cycle.
Access to device-to-backend log stores from accounts or hosts that do not normally read them.

Detection Strategies

Correlate backend request identifiers over time and alert when the same request identifier, nonce, or signature is observed more than once.
Baseline the volume and cadence of device-originated calls and flag deviations that indicate injected replays.
Monitor read access to logs containing device transmission data and alert on retrieval by non-service identities.

Monitoring Recommendations

Ingest ICS device, backend service, and log-storage telemetry into a centralized analytics platform for cross-source correlation.
Retain full request metadata long enough to detect delayed replay attempts against the backend.
Track authentication and authorization decisions on the backend and alert on repeated identical authentication material.

How to Mitigate CVE-2024-38284

Immediate Actions Required

Restrict and audit access to any log store that contains device-to-backend transmission data.
Rotate device credentials and any static tokens that may have been captured in existing logs.
Enable backend-side replay detection, rejecting duplicate request identifiers within an appropriate window.

Patch Information

Refer to CISA ICS Advisory ICSA-24-165-19 for vendor guidance, affected versions, and available fixes. Apply vendor updates that introduce nonces, sequence numbers, or signed timestamps into the device-to-backend protocol. Follow vendor instructions to sanitize logs so that reusable authentication material is no longer written to persistent storage.

Workarounds

Enforce mutual TLS between devices and the backend and terminate sessions frequently to shorten the window for replay.
Configure logging to redact authentication tokens, signatures, and request bodies that would enable replay.
Place the backend behind a gateway that enforces one-time request identifiers and rejects duplicates.

bash

# Configuration example
# Redact sensitive fields from device transmission logs (illustrative rsyslog rule)
:msg, contains, "Authorization:" ~
:msg, regex, "token=[A-Za-z0-9._-]+" replace "token=REDACTED"