CVE-2024-58343: Vision Helpdesk Information Disclosure

CVE-2024-58343 Overview

CVE-2024-58343 affects Vision Helpdesk before version 5.7.0, with a fix backported to 5.6.10. Attackers can read user profiles by submitting modified serialized cookie data through the vis_client_id parameter. The flaw maps to [CWE-425] Direct Request (Forced Browsing), allowing authenticated users to access profile data belonging to other accounts. Exploitation requires only low-privileged network access and no user interaction. Successful attacks expose user profile information but do not compromise integrity or availability of the helpdesk system.

Critical Impact
Authenticated attackers can read arbitrary user profile data by tampering with the vis_client_id serialized cookie value.

Affected Products

Vision Helpdesk versions prior to 5.7.0
Vision Helpdesk 5.6.x prior to 5.6.10
Vision Helpdesk customer portal (vis_client_id cookie handler)

Discovery Timeline

2026-04-16 - CVE-2024-58343 published to NVD
2026-04-17 - Last updated in NVD database

Technical Details for CVE-2024-58343

Vulnerability Analysis

Vision Helpdesk identifies the active client by reading a serialized PHP value stored in the vis_client_id cookie. The application deserializes this value and uses the embedded identifier to fetch the corresponding user profile. The server does not verify that the requesting session owns the identifier referenced in the cookie. This missing ownership check allows an authenticated user to substitute another user's ID and retrieve that profile.

The issue is classified as [CWE-425] Direct Request, a form of broken access control where the server trusts client-supplied identifiers. The vulnerability is reachable over the network with low attack complexity. Confidentiality of user profile records is impacted, while integrity and availability remain unaffected.

Root Cause

The root cause is improper authorization on requests that consume the vis_client_id cookie. The handler accepts the deserialized identifier as authoritative without binding it to the authenticated session. Any session-bound user can therefore enumerate or target profile records belonging to others.

Attack Vector

An attacker authenticates to the helpdesk portal, intercepts the vis_client_id cookie, and replaces the serialized identifier with another user's ID. Replaying the request returns the targeted user's profile data. The technique requires only an HTTP client capable of editing cookies, such as a browser extension or an intercepting proxy. Public proof-of-concept material is referenced in the GitHub Vision Helpdesk Exploit repository and the WebSec advisory.

No verified exploit code is reproduced here. See the linked references for technical details on cookie structure and request flow.

Detection Methods for CVE-2024-58343

Indicators of Compromise

Repeated profile-view requests from a single session targeting many distinct vis_client_id values
vis_client_id cookie values that decode to identifiers not bound to the authenticated session
Unexpected access patterns to /client/profile or equivalent profile endpoints during a single user session

Detection Strategies

Inspect web server access logs for sequential or scripted iteration over client IDs from the same source IP or session token
Correlate authenticated session identifiers with the deserialized vis_client_id value and alert on mismatches
Deploy a web application firewall rule that flags modified serialized PHP payloads in the vis_client_id cookie

Monitoring Recommendations

Enable verbose logging on the Vision Helpdesk authentication and profile modules
Forward helpdesk access logs to a centralized SIEM for behavioral analysis of profile read volumes per user
Track outbound responses for abnormal counts of profile records returned per session

How to Mitigate CVE-2024-58343

Immediate Actions Required

Upgrade Vision Helpdesk to 5.7.0 or apply the 5.6.10 backport patch
Invalidate active client sessions and force re-authentication after patching
Audit access logs for prior vis_client_id tampering and notify affected users if profile data was exposed

Patch Information

The vendor fixed the access control flaw in Vision Helpdesk 5.7.0, with the same fix backported to 5.6.10. Apply the upgrade through the official Vision Helpdesk update channel. Confirm post-upgrade that the profile endpoint validates session ownership of the vis_client_id value before returning data.

Workarounds

Restrict portal access to trusted networks or VPN until the patch is applied
Deploy a WAF rule to block requests where the deserialized vis_client_id does not match the authenticated session cookie
Shorten session lifetimes and rotate session identifiers frequently to limit cookie-replay windows

bash

# Example WAF rule (ModSecurity) to flag tampered vis_client_id cookies
SecRule REQUEST_COOKIES:vis_client_id "@rx ^[a-zA-Z]:[0-9]+:" \
    "id:1058343,phase:1,deny,status:403,\
    msg:'Possible CVE-2024-58343 vis_client_id tampering',\
    logdata:'%{MATCHED_VAR}'"