CVE-2024-6737: Electronic Official Document System Bypass

CVE-2024-6737 Overview

CVE-2024-6737 is a broken access control vulnerability in the Electronic Official Document Management System developed by 2100 TECHNOLOGY. The flaw allows authenticated remote attackers holding only regular user privileges to reach account management functionality that should be restricted to administrators. An attacker abusing this weakness can create a new administrator account and take full control of the application.

The issue is categorized under [CWE-284: Improper Access Control]. TW-CERT published the advisory describing the flaw and its impact on affected deployments.

Critical Impact
A low-privileged authenticated user can escalate to administrator by creating a new admin account, leading to full compromise of document confidentiality, integrity, and availability.

Affected Products

2100 TECHNOLOGY Electronic Official Document Management System (all versions listed in the TW-CERT advisory)
Deployments exposing the account settings endpoint to authenticated users
Environments where regular user accounts can reach administrative URLs

Discovery Timeline

2024-07-15 - CVE-2024-6737 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6737

Vulnerability Analysis

The Electronic Official Document Management System fails to enforce server-side authorization checks on the account settings functionality. The application relies on client-side controls or UI-level restrictions to hide administrative actions from regular users. Authenticated attackers can send crafted requests directly to the account management endpoints and bypass those controls.

Because the vulnerability sits in a document management platform used for official records, exploitation gives attackers access to confidential documents, workflows, and audit trails. The attacker can also modify or delete records after promoting themselves to an administrator role.

Root Cause

The root cause is missing function-level authorization on administrative endpoints. The application does not validate that the requesting session belongs to a user with administrator privileges before processing account creation requests. This maps directly to [CWE-284: Improper Access Control] and reflects a classic Broken Access Control pattern documented in the OWASP Top 10.

Attack Vector

Exploitation requires network access and a valid low-privileged account on the target system. The attacker authenticates normally, then issues a request to the account creation or role assignment endpoint used by administrators. The server processes the request without verifying the caller's role and provisions a new administrator account controlled by the attacker.

No user interaction is required from an administrator, and the attack complexity is low. See the TW-CERT Security Advisory for vendor-published technical details.

Detection Methods for CVE-2024-6737

Indicators of Compromise

Creation of new administrator accounts outside of scheduled provisioning windows
HTTP requests to account management endpoints originating from sessions belonging to standard users
Unexpected role changes or privilege elevations logged in the document management audit trail
Access to sensitive documents by newly created accounts shortly after their creation

Detection Strategies

Review application access logs for standard user sessions issuing requests to administrative URLs
Alert on any account creation event where the initiating principal is not part of the administrator group
Correlate authentication events with subsequent privilege changes on the same session

Monitoring Recommendations

Enable verbose logging on the Electronic Official Document Management System web tier and forward logs to a central SIEM
Baseline the normal rate and source of administrator account creation events
Monitor for horizontal movement from newly created admin accounts into document repositories

How to Mitigate CVE-2024-6737

Immediate Actions Required

Apply the vendor-supplied patch referenced in the TW-CERT Security Advisory as soon as it is available for your deployment
Restrict network access to the document management application to trusted internal networks or VPN users
Audit the current list of administrator accounts and remove any that cannot be attributed to a legitimate administrator
Force a password reset on all administrator accounts and enable multi-factor authentication where supported

Patch Information

2100 TECHNOLOGY coordinated with TW-CERT to publish the advisory. Administrators should contact the vendor directly to obtain the fixed release and confirm the exact build number that resolves CVE-2024-6737. Verify remediation by attempting the exploit path with a low-privileged test account after patching.

Workarounds

Place the application behind a reverse proxy or web application firewall that blocks non-administrator sessions from reaching account management URLs
Temporarily disable self-service account features until the patch is deployed
Review and tighten application-level role checks in any custom integrations with the document management system

bash

# Example WAF rule concept: block access to admin endpoints unless the session cookie
# belongs to a known administrator source IP range. Adjust paths to match your deployment.
location ~* /admin/(account|user|role) {
    allow 10.10.0.0/24;   # administrator jump hosts
    deny all;
    proxy_pass http://edms_backend;
}