CVE-2024-4259: Sambas Akos Auth Bypass Vulnerability

CVE-2024-4259 Overview

CVE-2024-4259 is a Missing Authorization vulnerability affecting SAMPAŞ Holding AKOS services, specifically the AkosCepVatandasService and TahsilatService components. This authorization bypass allows unauthenticated attackers to collect data as provided by users, potentially leading to unauthorized access to sensitive information and the ability to manipulate payment-related services.

Critical Impact

Unauthorized data collection and potential manipulation of citizen services and payment processing functionality due to missing authorization controls.

Affected Products

• SAMPAŞ Holding AKOS (AkosCepVatandasService) versions before V2.0
• SAMPAŞ Holding AKOS (TahsilatService) versions before V1.0.7
• Sambas AKOS platform services

Discovery Timeline

• 2024-09-03 - CVE-2024-4259 published to NVD
• 2025-10-14 - Last updated in NVD database

Technical Details for CVE-2024-4259

Vulnerability Analysis

This vulnerability stems from a fundamental missing authorization control (CWE-862) in the AKOS platform's web services. The affected components, AkosCepVatandasService (citizen mobile service) and TahsilatService (payment collection service), fail to properly verify that requestors are authorized to access the data and functionality they request.

The network-accessible nature of this vulnerability means attackers can reach the vulnerable services remotely without requiring any prior authentication or user interaction. This creates a scenario where sensitive citizen data and payment processing capabilities could be exposed to unauthorized parties.

Root Cause

The root cause is a missing authorization mechanism in the AKOS service layer. The AkosCepVatandasService and TahsilatService components do not implement proper access control checks before processing requests. This allows any network-accessible client to interact with these services and retrieve or manipulate data that should be protected by authorization controls. The vulnerability represents a classic broken access control pattern where the application assumes all incoming requests are legitimate without verifying the requestor's permissions.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying exposed AKOS service endpoints (AkosCepVatandasService or TahsilatService)
2. Sending crafted requests directly to the vulnerable services
3. Collecting user-provided data or interacting with payment functionality without authorization checks

The vulnerability allows attackers to collect data as provided by users through the citizen service interface, and potentially interact with payment collection services inappropriately. For detailed technical information about the exploitation methodology, refer to the USOM Security Notification TR-24-1377.

Detection Methods for CVE-2024-4259

Indicators of Compromise

• Unusual access patterns to AkosCepVatandasService or TahsilatService endpoints from unauthorized IP addresses
• High volume of API requests to citizen or payment services without corresponding authenticated sessions
• Unexpected data retrieval operations from the AKOS platform outside normal business hours
• Network traffic to AKOS services from geographic locations inconsistent with legitimate user base

Detection Strategies

• Implement logging and monitoring on all AKOS service endpoints to track access attempts
• Deploy web application firewalls (WAF) to detect and block unauthorized access patterns
• Enable audit logging for all data access and payment operations in the AKOS platform
• Configure SIEM rules to alert on anomalous access patterns to citizen data services

Monitoring Recommendations

• Monitor network traffic to AKOS services for signs of reconnaissance or data exfiltration
• Track API call volumes and flag unusual spikes in requests to vulnerable endpoints
• Review access logs regularly for signs of unauthorized data collection activities
• Implement real-time alerting for any access to sensitive citizen data without proper authentication tokens

How to Mitigate CVE-2024-4259

Immediate Actions Required

• Upgrade AkosCepVatandasService to version V2.0 or later immediately
• Upgrade TahsilatService to version V1.0.7 or later immediately
• Restrict network access to AKOS services to authorized IP ranges until patches can be applied
• Review access logs for signs of prior exploitation

Patch Information

SAMPAŞ Holding has addressed this vulnerability in the following versions:

Organizations should coordinate with SAMPAŞ Holding or their authorized reseller to obtain and deploy the patched versions. Additional details about the vulnerability and remediation can be found in the USOM Security Notification TR-24-1377.

Workarounds

• Implement network-level access controls (firewall rules, VPN requirements) to limit access to AKOS services to trusted networks only
• Deploy a reverse proxy or API gateway with authentication requirements in front of vulnerable services as a compensating control
• Monitor and audit all access to the affected services until patching is complete
• Consider temporarily disabling external access to vulnerable endpoints if the services are not business-critical

# Example: Network-level access restriction using iptables
# Restrict access to AKOS services to specific trusted IP ranges
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP