CVE-2024-8779: Syscomgo Omflow Privilege Escalation Flaw

CVE-2024-8779 Overview

CVE-2024-8779 is a broken access control vulnerability in OMFLOW, a workflow platform from The SYSCOM Group. The application fails to properly restrict access to system settings modification functionality. Authenticated attackers with regular user privileges can invoke privileged administrative operations, including modifying system settings and creating new accounts with administrator rights. Successful exploitation grants full control over the affected server. Taiwan's TWCERT published advisories describing the issue, which is tracked under [CWE-284] Improper Access Control.

Critical Impact
A remote authenticated user with low-privilege credentials can escalate to administrator, create rogue admin accounts, and take over the OMFLOW server, leading to full compromise of workflow data and integrated systems.

Affected Products

OMFLOW by The SYSCOM Group (syscomgo:omflow)
All versions prior to the vendor-supplied fix referenced in the TWCERT advisories
Deployments exposing the OMFLOW web interface to internal or external users

Discovery Timeline

2024-09-16 - CVE-2024-8779 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8779

Vulnerability Analysis

OMFLOW exposes system configuration endpoints that should be reachable only by administrative roles. The server does not enforce role-based authorization on these endpoints. Any authenticated user session, including one issued to a standard workflow user, can call the settings and account management functions. This design flaw maps directly to [CWE-284] Improper Access Control.

Because the check is missing on the server side, hiding the administrative options in the user interface does not prevent exploitation. Attackers craft direct HTTP requests to the privileged endpoints and receive successful responses. The vulnerability requires only network reachability to the OMFLOW web application and valid low-privilege credentials.

Root Cause

The root cause is missing server-side authorization enforcement on system settings and user management functions. OMFLOW appears to rely on client-side controls or session presence rather than verifying the role assigned to the authenticated principal before executing privileged operations. The server does not validate that the caller holds the administrator role for state-changing requests to configuration and account APIs.

Attack Vector

Exploitation proceeds in three steps. First, the attacker authenticates to OMFLOW using any regular account, which can be obtained through phishing, credential reuse, or standard user provisioning. Second, the attacker issues HTTP requests directly to the administrative endpoints responsible for updating system settings or creating users. Third, the attacker submits a request to create a new user and assigns it the administrator role, or modifies an existing account.

With administrator access established, the attacker can alter authentication configuration, disable logging, exfiltrate workflow data, and pivot into connected systems. No user interaction is required, and the entire chain executes over the network.

No verified public proof-of-concept code has been published. See the TWCERT Security Advisory 8076 and TWCERT Security Advisory 8075 for vendor-supplied technical details.

Detection Methods for CVE-2024-8779

Indicators of Compromise

Creation of new OMFLOW user accounts with administrator role assignments outside of documented change windows
Unexpected modifications to OMFLOW system settings, including authentication, logging, or integration configuration
HTTP requests to administrative OMFLOW endpoints originating from sessions tied to non-administrative user identifiers
Role changes on existing accounts elevating them to administrator without a corresponding ticket or approval record

Detection Strategies

Enable and review OMFLOW application audit logs for user.create, user.update, and settings.update events, correlating each event with the source account's assigned role
Deploy web application firewall or reverse proxy rules that log POST and PUT requests to OMFLOW administrative URL paths and alert on requests from non-admin sessions
Baseline the normal set of accounts that legitimately hit administrative endpoints and alert on deviations

Monitoring Recommendations

Forward OMFLOW web server access logs and application logs to a centralized SIEM for correlation with identity events
Alert on any newly created account whose first successful login is followed by administrative changes within a short window
Monitor authentication providers integrated with OMFLOW for privilege changes that were not initiated through the standard admin console

How to Mitigate CVE-2024-8779

Immediate Actions Required

Restrict network access to the OMFLOW web interface using firewall rules or VPN-only access until a patched version is deployed
Audit all existing OMFLOW user accounts and remove or disable any unrecognized administrator accounts
Rotate credentials for all OMFLOW users, prioritizing administrator accounts, and enforce multi-factor authentication where the platform supports it
Review OMFLOW audit logs for evidence of unauthorized settings changes or account creations dating back to before the advisory publication

Patch Information

The SYSCOM Group has issued a fixed release addressed in the TWCERT advisories. Administrators should consult the TWCERT Security Advisory 8076 and TWCERT Security Advisory 8075 for the vendor-supplied fixed version and upgrade instructions. Apply the update to all OMFLOW instances, including test and staging environments.

Workarounds

Place OMFLOW behind a reverse proxy that enforces additional authorization checks on administrative URL paths
Limit OMFLOW user accounts to the minimum set required for business operations and disable self-service registration
Segment OMFLOW servers from sensitive internal networks so that a full server takeover does not immediately extend to other assets
Increase monitoring frequency on OMFLOW audit logs until the patch is confirmed applied across all instances

bash

# Example: restrict OMFLOW admin paths at an nginx reverse proxy
# Adjust admin_path and allowed_admin_cidr for your environment
location ~* ^/(admin|system|users)(/|$) {
    allow 10.0.10.0/24;   # admin workstation subnet
    deny  all;
    proxy_pass http://omflow_backend;
}