CVE-2024-8261: Prolizyazilim OBS Auth Bypass Vulnerability

CVE-2024-8261 Overview

CVE-2024-8261 is an authorization bypass vulnerability in Proliz Software's Student Affairs Information System (OBS). The flaw stems from incorrectly configured access control security levels combined with user-controlled keys [CWE-639]. Unauthenticated remote attackers can manipulate identifiers in requests to access or modify records belonging to other users. The vulnerability affects all OBS releases prior to version 24.0927. Turkish national cyber authorities published advisories tracking this issue under reference TR-25-0049.

Critical Impact

An unauthenticated network attacker can bypass authorization controls to read, alter, or delete student records and administrative data, fully compromising confidentiality, integrity, and availability.

Affected Products

• Proliz Software OBS (Student Affairs Information System) versions before 24.0927
• Deployments of OBS used by higher-education institutions for student records management
• Web-facing OBS portals reachable from the internet without compensating access controls

Discovery Timeline

• 2025-03-03 - CVE-2024-8261 published to the National Vulnerability Database
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2024-8261

Vulnerability Analysis

The vulnerability is classified as Authorization Bypass Through User-Controlled Key, mapped to [CWE-639]. OBS exposes object references, such as student identifiers or record keys, directly in request parameters. The application fails to verify that the authenticated session owns the referenced object before returning or modifying data. This pattern is commonly known as Insecure Direct Object Reference (IDOR).

Because the access control configuration is set at an insufficient security level, sensitive endpoints accept manipulated identifiers without enforcing session-to-object binding. An attacker who substitutes another user's key in a request retrieves or alters that user's data. Exploitation requires no privileges and no user interaction, and the attack is delivered over the network.

Root Cause

The root cause is improper enforcement of per-object authorization checks. The application trusts client-supplied keys to determine which record to operate on. Server-side logic does not cross-check the supplied identifier against the authenticated principal's permitted scope. Vendor remediation in build 24.0927 addresses the access control configuration.

Attack Vector

Exploitation occurs over HTTP(S) against the OBS web interface. An attacker enumerates or guesses valid record identifiers and submits them in URL parameters, form fields, or API request bodies. The server returns or updates data without validating ownership. The vulnerability manifests in endpoints that handle student records, grades, course enrollments, or administrative actions. See the USOM Security Notification and the Siber Guvenlik Security Notification for vendor-coordinated advisory details.

Detection Methods for CVE-2024-8261

Indicators of Compromise

• Sequential or enumerated identifier values in OBS request logs originating from a single source IP
• Successful HTTP 200 responses to requests where the session user does not match the referenced record owner
• Anomalous bulk record access patterns against student record endpoints
• Unexpected modifications to student data, grades, or enrollment entries outside normal administrative workflows

Detection Strategies

• Audit OBS application logs for requests where the user-supplied identifier parameter diverges from the authenticated session's expected scope
• Correlate session identifiers with accessed record keys to surface horizontal access violations
• Deploy web application firewall rules that flag rapid iteration of numeric or sequential keys against OBS endpoints

Monitoring Recommendations

• Enable verbose access logging on OBS web servers and forward logs to a centralized SIEM for retention and analysis
• Alert on spikes in unique record identifiers requested per session or per source IP within short time windows
• Monitor outbound data volumes from OBS servers for signs of bulk record exfiltration

How to Mitigate CVE-2024-8261

Immediate Actions Required

• Upgrade Proliz OBS to version 24.0927 or later on all instances
• Restrict OBS administrative interfaces to trusted networks or VPN-only access until patching is complete
• Review web server and application logs for prior exploitation attempts against record-access endpoints
• Force password resets for accounts that may have been exposed through unauthorized record access

Patch Information

Proliz Software addressed the vulnerability in OBS build 24.0927. Operators should coordinate with the vendor to obtain the patched release and apply it across all production and staging environments. The Turkish national cybersecurity advisory TR-25-0049 references the fixed version. Verify the installed build after deployment to confirm remediation.

Workarounds

• Place OBS behind a web application firewall configured to inspect and rate-limit access to endpoints that accept record identifiers
• Apply network-level access controls limiting OBS exposure to authenticated institutional networks where feasible
• Increase logging fidelity and review access patterns daily until the patched version is deployed

# Configuration example: WAF rate-limit rule pattern for OBS record endpoints
# Limit requests per session to record endpoints to detect enumeration
location /obs/student/ {
    limit_req zone=obs_records burst=10 nodelay;
    limit_req_status 429;
}