CERT-In Vulnerability Note
CIVN-2024-0296
Multiple Vulnerabilities in Apex Softcell products
Original Issue Date:September 18, 2024
Severity Rating: HIGH
Systems Affected
- Apex Softcell LD Geo versions prior to 4.0.0.7
- Apex Softcell LD DP Back Office versions prior to 24.8.21.1
Overview
Multiple vulnerabilities have been reported in Apex Softcell products, which could allow a remote attacker to perform user enumeration, bypass OTP verification, unauthorized transaction manipulation or gain unauthorized access to sensitive information of other user accounts.
Description
1. Parameter Manipulation Vulnerability
(
CVE-2024-47085
)
This vulnerability exists in LD DP Back Office due to improper validation of certain parameters "cCdslClicentcode" and "cLdClientCode" in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive information belonging to other users.
2. OTP Bypass Vulnerability
(
CVE-2024-47086
)
This vulnerability exists in LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API response.
Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for other user accounts.
3. Information Disclosure Vulnerability
(
CVE-2024-47087
)
This vulnerability exists in LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive information belonging to other users.
4. User Enumeration Vulnerability
(
CVE-2024-47088
)
This vulnerability exists in LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.
5. Unauthorized Transaction Manipulation Vulnerability
(
CVE-2024-47089
)
This vulnerability exists in the LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and modification of transactions belonging to other users.
Credit
These vulnerabilities are reported by Mohit Gadiya.
Solution
- Upgrade Apex Softcell LD Geo to version 4.0.0.7
- Upgrade Apex Softcell LD DP Back Office to version 24.8.21.1
Vendor Information
Apex Softcell
http://www.apexsoftcell.com/ld_dp_back_office.html
http://www.apexsoftcell.com/ld_geo.html
References
Apex Softcell
http://www.apexsoftcell.com/ld_dp_back_office.html
http://www.apexsoftcell.com/ld_geo.html
CVE Name
CVE-2024-47085
CVE-2024-47086
CVE-2024-47087
CVE-2024-47088
CVE-2024-47089
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|