CVE-2024-53355: Easyvirt Co2scope Auth Bypass Vulnerability

CVE-2024-53355 Overview

CVE-2024-53355 is a broken access control vulnerability affecting EasyVirt DCScope versions up to and including 8.6.0 and CO2Scope versions up to and including 1.3.0. The flaw exposes twelve user, group, and role management API endpoints without proper authorization enforcement. Remote authenticated attackers with low-privilege accounts can escalate to administrator by invoking these endpoints directly. The vulnerability is tracked under CWE-281: Improper Preservation of Permissions.

Critical Impact
A low-privilege authenticated user can add admin accounts, modify roles, and take full control of DCScope and CO2Scope deployments used to monitor virtualized datacenter infrastructure.

Affected Products

EasyVirt DCScope versions <= 8.6.0
EasyVirt CO2Scope versions <= 1.3.0
Deployments exposing the /api/user/* administrative routes

Discovery Timeline

2025-01-31 - CVE-2024-53355 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53355

Vulnerability Analysis

The vulnerability stems from missing server-side authorization checks on twelve REST endpoints under the /api/user/ path. These endpoints govern the identity model of the application, covering user aliases, groups, and roles. Any authenticated session, regardless of assigned role, can invoke privileged operations against them.

An attacker with a standard user account can call /api/user/addalias to create a new administrator account. The same session can invoke /api/user/updaterole and /api/user/adduser to add root-level groups and elevate role permissions. Enumeration endpoints such as /api/user/aliases, /api/user/users, and /api/user/roles allow the attacker to map the existing identity model before tampering with it.

The impact extends to confidentiality, integrity, and availability. Because DCScope and CO2Scope are used to monitor VMware and datacenter energy consumption workloads, an attacker gaining administrative access can access sensitive telemetry, disable monitoring, or pivot into the connected hypervisor environment.

Root Cause

The application authenticates users but does not enforce role-based authorization at the API layer. Administrative routes rely on client-side controls or route obscurity, which are bypassed by direct HTTP requests. This design flaw maps to CWE-281, where permission checks are not preserved across privileged actions.

Attack Vector

Exploitation requires network access to the DCScope or CO2Scope web interface and any valid low-privilege credential. The attacker authenticates normally, then issues HTTP requests to the vulnerable /api/user/* endpoints. No user interaction is required, and no elevated privileges are needed to trigger the flaw. Technical details are documented in the GitHub PoC repository by Elymaro.

Detection Methods for CVE-2024-53355

Indicators of Compromise

Unexpected new user aliases or roles appearing in DCScope or CO2Scope audit logs
HTTP requests to /api/user/addalias, /api/user/addrole, or /api/user/adduser originating from non-administrator sessions
Sequential API calls to enumeration endpoints such as /api/user/aliases, /api/user/users, and /api/user/roles from a single low-privilege session
Role or group modifications performed outside of change-management windows

Detection Strategies

Correlate the authenticated user's assigned role with the API endpoint invoked; low-privilege sessions calling admin routes indicate exploitation
Enable verbose web server access logging on the DCScope and CO2Scope frontends and forward logs to a central SIEM
Alert on any successful HTTP 200 response to /api/user/addalias or /api/user/addrole from accounts not on an allowlist of administrators

Monitoring Recommendations

Baseline normal administrative API traffic and alert on deviations, especially outside business hours
Review DCScope and CO2Scope user and role directories daily until patched versions are deployed
Monitor downstream hypervisor and vCenter authentication events for lateral movement following any suspected DCScope compromise

How to Mitigate CVE-2024-53355

Immediate Actions Required

Restrict network access to DCScope and CO2Scope management interfaces to trusted administrative networks only
Audit all existing user aliases, groups, and roles in both applications and remove entries not tied to a known administrator
Rotate credentials for any low-privilege accounts, particularly if they have accessed the interface recently
Contact EasyVirt for a fixed release and deployment guidance

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Administrators should contact EasyVirt directly for a fixed build of DCScope beyond version 8.6.0 and CO2Scope beyond version 1.3.0. Refer to the GitHub PoC repository for reproduction details when validating a patch.

Workarounds

Place DCScope and CO2Scope behind a reverse proxy that enforces authorization on /api/user/* routes based on session role
Disable or firewall the /api/user/ administrative endpoints for non-administrator source IP ranges
Reduce the number of low-privilege application accounts and enforce strong authentication for every session

bash

# Example nginx block restricting /api/user/ admin routes to a management subnet
location /api/user/ {
    allow 10.10.0.0/24;   # admin management subnet
    deny all;
    proxy_pass http://dcscope_backend;
}