CVE-2024-41699: Priority Software Information Disclosure

CVE-2024-41699 Overview

CVE-2024-41699 affects Priority Software's Priority enterprise resource planning (ERP) platform. The vulnerability is classified under [CWE-552], which covers files or directories accessible to external parties. An unauthenticated remote attacker can reach sensitive resources over the network without user interaction. The flaw exposes confidential information without affecting integrity or availability. The Israeli National Cyber Directorate published the advisory through the Israeli Government CVE Advisories portal.

Critical Impact

Unauthenticated network attackers can access files or directories that should be restricted, leading to disclosure of sensitive business data stored in the Priority ERP environment.

Affected Products

• Priority Software Priority ERP (priority-software:priority)
• Deployments exposing Priority web or file services to untrusted networks
• Versions prior to the vendor-supplied security update

Discovery Timeline

• 2024-08-20 - CVE-2024-41699 published to the National Vulnerability Database (NVD)
• 2024-09-03 - Last updated in NVD

Technical Details for CVE-2024-41699

Vulnerability Analysis

The vulnerability stems from improper access controls on files or directories within the Priority ERP application. External parties can request resources that the application should restrict to authenticated or privileged users. The advisory categorizes the weakness as [CWE-552], a class of issues where resource access controls fail to enforce intended boundaries.

Exploitation requires no authentication and no user interaction. The attack vector is network-based, meaning an attacker can target exposed Priority instances directly over HTTP or HTTPS. Successful exploitation results in confidentiality loss without modifying server-side data or disrupting service availability.

Root Cause

The root cause is missing or insufficient authorization checks on file or directory paths served by the Priority application. The application returns content from paths that should be gated by authentication or role-based access controls. This pattern typically arises when static resource handlers, download endpoints, or report directories are mapped without verifying caller identity.

Attack Vector

An attacker reaches the vulnerable endpoint over the network and issues a request for a sensitive file or directory listing. Because the server does not validate the requester's authorization, it returns the requested content. The attacker can iterate through known or predictable resource paths to enumerate sensitive files. Refer to the Israeli Government CVE Advisories for additional technical detail published by the coordinating authority.

// No verified public proof-of-concept is available.
// Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2024-41699

Indicators of Compromise

• Unauthenticated HTTP requests to Priority file, report, or document endpoints originating from external IP ranges
• Anomalous volumes of GET requests targeting static resource paths or directory listings on the Priority server
• Access log entries showing successful 200 responses for sensitive file paths without a preceding authentication session

Detection Strategies

• Review Priority application access logs for requests that return sensitive content without an associated authenticated session identifier
• Correlate web server logs with authentication logs to surface file downloads that lack a valid login event
• Deploy web application firewall (WAF) rules that flag access to known sensitive directories on the Priority application

Monitoring Recommendations

• Forward Priority web server and application logs to a centralized analytics platform for retention and correlation
• Alert on bursts of requests from a single source to file-serving endpoints outside normal business workflows
• Monitor egress data volumes from Priority hosts to detect bulk extraction patterns

How to Mitigate CVE-2024-41699

Immediate Actions Required

• Apply the security update referenced in the Israeli Government CVE Advisories for Priority
• Restrict network exposure of Priority application interfaces to trusted networks or VPN-only access
• Audit Priority access logs since deployment to identify potential unauthorized file access

Patch Information

Priority Software has coordinated remediation through the Israeli National Cyber Directorate. Administrators should obtain the corrective update directly from Priority Software and apply it to all affected production and non-production instances. Validate the patched version after deployment by confirming that previously accessible file paths now require authentication.

Workarounds

• Place the Priority application behind a reverse proxy that enforces authentication before forwarding requests to sensitive paths
• Apply WAF rules to block unauthenticated requests to file-serving endpoints until the patch is deployed
• Limit inbound access to the Priority server using network access control lists (ACLs) and allowlists

# Example: restrict Priority application access to a trusted CIDR using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP