CVE-2024-45229: Versa Director Auth Bypass Vulnerability

CVE-2024-45229 Overview

CVE-2024-45229 is a REST API vulnerability in Versa Director that allows unauthenticated attackers to exploit certain APIs by injecting invalid arguments into GET requests. This exploitation can potentially expose authentication tokens of other currently logged-in users. The exposed tokens can then be used to invoke additional APIs on port 9183, enabling unauthorized access to management functions.

Critical Impact

Authentication tokens of logged-in users can be stolen through API manipulation, potentially allowing attackers to impersonate legitimate administrators and access orchestration and management functions.

Affected Products

• Versa Director (Internet-exposed instances)
• Versa Director REST APIs on ports 9182, 9183, and 443
• Versa Director device registration endpoints

Discovery Timeline

• 2024-09-20 - CVE-2024-45229 published to NVD
• 2024-09-26 - Last updated in NVD database

Technical Details for CVE-2024-45229

Vulnerability Analysis

This vulnerability affects the Versa Director platform, which provides REST APIs for orchestration and management of network infrastructure. By design, certain APIs such as the login screen, banner display, and device registration endpoints do not require authentication to function properly.

The core issue lies in the improper handling of input validation on these unauthenticated API endpoints. When the Versa Director is directly connected to the Internet, an attacker can craft malicious GET requests with invalid arguments to one of these APIs. This improper input handling results in the exposure of authentication tokens belonging to other users who are currently logged into the system.

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the affected API endpoint lacks proper authentication controls despite handling sensitive token information.

Root Cause

The root cause of this vulnerability is the missing authentication mechanism for a critical API function. While certain APIs are intentionally designed to operate without authentication for legitimate purposes (login screen, banner display, device registration), one of these unauthenticated endpoints improperly exposes sensitive authentication token data when processing malformed input parameters.

The vulnerability stems from insufficient input validation combined with the lack of proper access controls on the API response data. When invalid arguments are injected into GET requests, the application fails to properly sanitize or restrict the information returned, inadvertently leaking session tokens of authenticated users.

Attack Vector

The attack vector requires the Versa Director to be directly exposed to the Internet. An attacker can exploit this vulnerability remotely without any authentication by:

1. Identifying Internet-exposed Versa Director instances
2. Crafting malicious GET requests with invalid arguments targeting the vulnerable API endpoints at /vnms/devicereg/device/* (ports 9182 & 9183) or /versa/vnms/devicereg/device/* (port 443)
3. Extracting authentication tokens from the API response
4. Using the stolen tokens to invoke additional authenticated APIs on port 9183

Notably, this exploit does not disclose any username or password information directly—only the session authentication tokens. However, these tokens provide sufficient access to invoke management APIs as the compromised user.

Detection Methods for CVE-2024-45229

Indicators of Compromise

• Unusual or malformed GET requests to /vnms/devicereg/device/* endpoints on ports 9182 or 9183
• Anomalous API traffic patterns to /versa/vnms/devicereg/device/* on port 443
• Authentication tokens being used from unexpected IP addresses or geographic locations
• Multiple API calls originating from the same source using different user session tokens

Detection Strategies

• Monitor web server access logs for GET requests containing invalid or unexpected arguments to device registration endpoints
• Implement network intrusion detection rules to identify reconnaissance or exploitation attempts targeting Versa Director APIs
• Analyze authentication logs for session tokens being used from multiple concurrent IP addresses
• Deploy behavioral analytics to detect anomalous API usage patterns that may indicate token theft

Monitoring Recommendations

• Enable detailed logging on Versa Director API endpoints, particularly for device registration functions
• Configure alerting for high-volume or suspicious requests to the vulnerable URL paths
• Implement session monitoring to detect tokens being used from unauthorized network locations
• Regularly audit API access patterns for indicators of token harvesting or misuse

How to Mitigate CVE-2024-45229

Immediate Actions Required

• Verify if your Versa Director instances are directly exposed to the Internet and assess exposure risk
• Implement Web Application Firewall (WAF) or API Gateway rules to block access to vulnerable endpoints
• Review authentication logs for any signs of token compromise or unauthorized API access
• Contact Versa Technical Support or your Versa account team for upgrade guidance and assistance

Patch Information

Versa Networks recommends upgrading Directors to one of the remediated software versions. For specific version information and patch downloads, refer to the Versa Networks Security Bulletin. Versa has confirmed that no Versa-hosted head ends have been affected by this vulnerability.

Workarounds

• Deploy a Web Application Firewall (WAF) or API Gateway in front of Versa Director to filter malicious requests
• Configure blocking rules for /vnms/devicereg/device/* on ports 9182 and 9183
• Configure blocking rules for /versa/vnms/devicereg/device/* on port 443
• If possible, remove direct Internet exposure of Versa Director instances until patches can be applied
• Implement network segmentation to limit access to Versa Director management interfaces

# Example WAF/API Gateway blocking rules (syntax varies by platform)
# Block access to vulnerable device registration endpoints
# Port 9182/9183 endpoints
deny /vnms/devicereg/device/*
# Port 443 endpoints  
deny /versa/vnms/devicereg/device/*