CVE-2024-55215: Jrohy Trojan Privilege Escalation Flaw

CVE-2024-55215 Overview

CVE-2024-55215 is a critical privilege escalation vulnerability affecting Jrohy Trojan, a proxy management tool. The vulnerability exists in versions 2.0.0 through 2.15.3 and allows remote attackers to escalate privileges via the initialization interface at /auth/register. This authentication bypass flaw enables unauthenticated users to create administrative accounts, potentially gaining full control over the affected system.

Critical Impact

Remote attackers can exploit the registration endpoint to create privileged accounts without authentication, leading to complete system compromise.

Affected Products

• Jrohy Trojan versions 2.0.0 through 2.15.3
• Systems exposing the /auth/register endpoint to untrusted networks
• Deployments without additional access controls on the registration interface

Discovery Timeline

• 2025-02-07 - CVE-2024-55215 published to NVD
• 2025-07-03 - Last updated in NVD database

Technical Details for CVE-2024-55215

Vulnerability Analysis

This vulnerability is classified under CWE-276 (Incorrect Default Permissions). The Jrohy Trojan application fails to properly restrict access to its initialization and registration interface located at /auth/register. Under normal operation, this endpoint should only be accessible during initial setup or by authenticated administrators. However, due to improper access controls, the endpoint remains accessible to unauthenticated remote users, allowing them to create new accounts with elevated privileges.

The network-accessible nature of this vulnerability, combined with the lack of required authentication or user interaction, makes it particularly dangerous for exposed deployments. Successful exploitation grants attackers the ability to read sensitive configuration data, modify system settings, and potentially pivot to other network resources.

Root Cause

The root cause of CVE-2024-55215 lies in incorrect default permissions applied to the /auth/register endpoint. The application does not implement proper authorization checks to verify whether the registration functionality should be accessible based on the current system state or the requester's authentication status. This design flaw allows the initialization interface to remain open indefinitely after initial setup, contrary to secure-by-default principles.

Attack Vector

The attack is executed over the network by sending crafted HTTP requests to the /auth/register endpoint. An attacker can exploit this vulnerability by:

1. Identifying an exposed Jrohy Trojan instance by scanning for the web interface
2. Accessing the /auth/register endpoint directly without authentication
3. Submitting a registration request to create a new administrative user account
4. Using the newly created credentials to authenticate and gain full administrative access

The vulnerability requires no prior authentication, no user interaction, and can be exploited remotely with low attack complexity. For detailed technical information and proof-of-concept details, see the GitHub PoC Repository.

Detection Methods for CVE-2024-55215

Indicators of Compromise

• Unexpected HTTP requests to /auth/register endpoint from external IP addresses
• Creation of new administrative user accounts not authorized by system administrators
• Authentication logs showing successful logins from previously unknown accounts
• Unusual administrative actions following registration activity

Detection Strategies

• Monitor web server access logs for requests targeting /auth/register from untrusted sources
• Implement alerting for new user account creation events in the Trojan management system
• Deploy web application firewalls (WAF) with rules to detect and block unauthorized registration attempts
• Review authentication logs regularly for anomalous login patterns

Monitoring Recommendations

• Enable detailed logging for all authentication and registration events
• Configure SIEM rules to correlate registration attempts with subsequent privileged actions
• Establish baseline user account inventory and alert on deviations
• Monitor network traffic for reconnaissance activity targeting Trojan management interfaces

How to Mitigate CVE-2024-55215

Immediate Actions Required

• Restrict network access to the Jrohy Trojan management interface using firewall rules
• Audit existing user accounts for any unauthorized administrative accounts
• Disable or remove the /auth/register endpoint if initial setup is complete
• Update to a patched version of Jrohy Trojan when available

Patch Information

At the time of publication, users should monitor the official Jrohy repository for security updates addressing this vulnerability. Review the GitHub PoC Repository for additional context and mitigation guidance. Organizations running affected versions should prioritize network-level controls until an official patch is released.

Workarounds

• Implement network access controls to restrict /auth/register endpoint access to trusted IP addresses only
• Deploy a reverse proxy with authentication requirements in front of the Trojan management interface
• Use firewall rules to limit management interface access to administrative networks
• Consider temporarily disabling the web management interface if not actively required

# Example: Block external access to registration endpoint using iptables
# Allow only localhost access to the Trojan management port (adjust port as needed)
iptables -A INPUT -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s YOUR_ADMIN_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP