CVE-2024-8777: Syscomgo Omflow Info Disclosure Flaw

CVE-2024-8777 Overview

CVE-2024-8777 is an information leakage vulnerability in OMFLOW from The SYSCOM Group. Unauthorized remote attackers can read arbitrary system configurations without authentication. When Lightweight Directory Access Protocol (LDAP) authentication is enabled on the affected installation, attackers can also retrieve plaintext credentials from the exposed configuration data.

The weakness maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor and [CWE-522] Insufficiently Protected Credentials. The vulnerability is exploitable over the network with low complexity and requires no user interaction.

Critical Impact
Remote unauthenticated attackers can read arbitrary OMFLOW system configurations and harvest plaintext LDAP credentials, enabling follow-on access to directory services and downstream enterprise systems.

Affected Products

Syscomgo OMFLOW (workflow management platform)
Deployments with LDAP authentication enabled are exposed to plaintext credential disclosure
Refer to vendor advisories for the specific fixed build numbers

Discovery Timeline

2024-09-16 - CVE-2024-8777 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8777

Vulnerability Analysis

The vulnerability allows unauthenticated remote callers to access configuration endpoints in OMFLOW that should be restricted to administrators. The application returns arbitrary system configuration data in response to requests that do not enforce authentication or authorization. Attackers retrieve this data directly over the network with a standard HTTP client.

When LDAP authentication is configured for the OMFLOW instance, the exposed configuration includes the bind account credentials in cleartext. Because LDAP service accounts often have broad read access to directory objects, the leaked credentials provide a direct path into the organization's identity infrastructure. Attackers can pivot from a single unauthenticated request to enumerating users, groups, and group policies inside the directory.

Root Cause

The root cause is a missing access control on configuration retrieval functionality, combined with storage of LDAP bind credentials in a recoverable, plaintext form. The two defects compound: an information disclosure flaw [CWE-200] exposes a resource that also violates credential protection requirements [CWE-522]. Either condition alone would be a security finding; together they convert a configuration read into full credential theft.

Attack Vector

The attack vector is network-based and does not require credentials, user interaction, or prior foothold. An attacker locates an internet-reachable or intranet-reachable OMFLOW instance and issues requests to the vulnerable configuration interface. The server returns the configuration payload, which the attacker parses to extract LDAP bind data, integration secrets, and other operational settings. No exploit code is publicly tracked in Exploit-DB at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the TW-CERT Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2024-8777

Indicators of Compromise

Unauthenticated HTTP GET requests to OMFLOW configuration or settings endpoints originating from external or non-administrative source addresses
Anomalous LDAP bind activity using the OMFLOW service account from hosts that are not the OMFLOW application server
Outbound responses from the OMFLOW server containing configuration field names such as LDAP bind DN, password, or server URI
Successful directory enumeration queries shortly after access to the OMFLOW web interface

Detection Strategies

Inspect web server and reverse proxy logs for access to OMFLOW administrative or configuration paths without an authenticated session cookie
Correlate OMFLOW request logs with LDAP authentication logs to flag service account use from unexpected client IPs
Alert on large response payloads from OMFLOW endpoints that typically return small or empty bodies for unauthenticated callers

Monitoring Recommendations

Forward OMFLOW application, web server, and LDAP directory logs to a centralized analytics platform for correlation
Establish a baseline of legitimate OMFLOW administrative source IPs and alert on deviations
Monitor directory service for sudden spikes in read or search operations performed by the OMFLOW bind account

How to Mitigate CVE-2024-8777

Immediate Actions Required

Restrict network access to the OMFLOW management interface to trusted administrative networks using firewall or reverse proxy rules
Rotate the LDAP bind account password and any other secrets stored in the OMFLOW configuration immediately
Audit directory service logs for unauthorized use of the OMFLOW bind account since the system was first deployed
Contact The SYSCOM Group to confirm the fixed OMFLOW build and schedule the upgrade

Patch Information

The SYSCOM Group has coordinated remediation through TW-CERT. Apply the vendor-supplied fixed version of OMFLOW as published in the TW-CERT Security Notice. No public vendor advisory URL beyond the TW-CERT coordination pages is listed in the NVD entry, so confirm the exact build number directly with the vendor before deploying.

Workarounds

Place the OMFLOW server behind an authenticating reverse proxy that blocks anonymous access to configuration endpoints
Use a dedicated LDAP bind account with read-only scope limited to the attributes OMFLOW requires, reducing the impact of credential disclosure
Disable LDAP integration on OMFLOW until the patch is applied if the integration is not operationally required

bash

# Example: restrict OMFLOW access to an administrative subnet via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP