CVE-2024-45790: Reedos Aim-Star Auth Bypass Vulnerability

CVE-2024-45790 Overview

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API-based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to unauthorized access and compromise of other user accounts.

Critical Impact
Remote attackers can exploit this authentication weakness to gain unauthorized access to user accounts through brute force attacks, potentially compromising the entire system and sensitive data.

Affected Products

Reedos aiM-Star version 2.0.1

Discovery Timeline

September 11, 2024 - CVE-2024-45790 published to NVD
September 18, 2024 - Last updated in NVD database

Technical Details for CVE-2024-45790

Vulnerability Analysis

This vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) represents a fundamental authentication security flaw in the Reedos aiM-Star application. The API-based login endpoint lacks rate limiting or account lockout mechanisms, allowing attackers to submit unlimited authentication attempts without restriction.

The absence of brute force protection means that attackers can systematically enumerate valid credentials by testing large password dictionaries against known usernames. This type of vulnerability is particularly dangerous because it requires minimal technical expertise to exploit—automated tools can rapidly attempt thousands of password combinations until valid credentials are discovered.

Once an attacker successfully authenticates through brute force, they gain the same level of access as the legitimate user. This could include access to sensitive business data, the ability to perform actions on behalf of the compromised user, and potentially pivot to attack other accounts within the system.

Root Cause

The root cause of this vulnerability is the absence of authentication rate limiting controls on the API login endpoint. The application fails to implement standard security measures such as:

Account lockout after consecutive failed attempts
Progressive time delays between authentication attempts
CAPTCHA challenges after suspicious activity
IP-based request throttling

Without these controls, the authentication system cannot distinguish between legitimate login attempts and automated brute force attacks.

Attack Vector

This vulnerability is exploitable over the network without requiring prior authentication or user interaction. An attacker can target the API login endpoint remotely using automated tools to conduct dictionary attacks or credential stuffing campaigns.

The attack workflow typically involves:

Identifying valid usernames through user enumeration or other reconnaissance
Configuring automated brute force tools (such as Hydra, Burp Suite Intruder, or custom scripts) to target the API login endpoint
Submitting authentication requests with common password combinations
Monitoring responses for successful authentication indicators
Gaining access to compromised accounts

No proof-of-concept code is publicly available. For technical details, refer to the CERT-IN Advisory CIVN-2024-0291.

Detection Methods for CVE-2024-45790

Indicators of Compromise

Multiple failed authentication attempts from single IP addresses targeting the aiM-Star API login endpoint
Unusually high volume of login requests within short time periods
Authentication attempts using common password patterns or dictionary words
Successful logins following numerous failed attempts from the same source

Detection Strategies

Implement logging and alerting for failed authentication attempts exceeding threshold values (e.g., 5+ failures within 5 minutes)
Monitor network traffic for patterns indicative of automated brute force tools
Deploy web application firewalls (WAF) with brute force detection rules
Analyze authentication logs for credential stuffing patterns (valid usernames with rotating passwords)

Monitoring Recommendations

Enable detailed authentication logging on the aiM-Star application
Configure SIEM rules to correlate failed login events and alert on suspicious patterns
Monitor for anomalous login success events following extended failure periods
Track authentication attempt rates by source IP and username

How to Mitigate CVE-2024-45790

Immediate Actions Required

Contact Reedos for security updates or patches addressing this vulnerability
Implement network-level rate limiting for API authentication endpoints
Deploy a web application firewall (WAF) with brute force protection capabilities
Enforce strong password policies and multi-factor authentication (MFA) where possible
Review authentication logs for evidence of prior exploitation attempts

Patch Information

Organizations should consult the CERT-IN Advisory CIVN-2024-0291 for official guidance and contact Reedos directly for available security patches or updated versions of aiM-Star that address this authentication vulnerability.

Workarounds

Implement IP-based rate limiting using reverse proxy or firewall configurations to restrict authentication attempts
Configure account lockout policies at the infrastructure level if application-level controls are unavailable
Restrict access to the aiM-Star API login endpoint to trusted IP ranges using network ACLs
Deploy fail2ban or similar intrusion prevention tools to automatically block suspicious IP addresses

bash

# Example nginx rate limiting configuration for API endpoints
# Add to nginx.conf or site configuration

limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/m;

location /api/login {
    limit_req zone=login_limit burst=3 nodelay;
    limit_req_status 429;
    # Proxy to aiM-Star backend
    proxy_pass http://aim-star-backend;
}