CVE-2024-0912
📋 TL;DR
This vulnerability causes Microsoft IIS servers hosting C•CURE 9000 Web Server to log Windows credential details in log files under certain circumstances. This affects organizations using C•CURE 9000 Web Server on IIS. There is no impact to non-web service interfaces or prior versions of C•CURE 9000.
💻 Affected Systems
- C•CURE 9000 Web Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to log files containing Windows credentials, potentially leading to credential theft, lateral movement, and privilege escalation within the network.
Likely Case
Credential exposure in log files that could be accessed by unauthorized users or attackers who have already compromised the system, leading to credential harvesting.
If Mitigated
Limited impact with proper log file access controls and monitoring, though credentials remain exposed in logs.
🎯 Exploit Status
Exploitation requires accessing log files containing the credentials, which typically requires some level of system access or log exposure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: C•CURE 9000 Web Server version 3.10.0
Vendor Advisory: https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf
Restart Required: Yes
Instructions:
1. Download C•CURE 9000 Web Server version 3.10.0 from Johnson Controls. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the IIS service and verify functionality.
🔧 Temporary Workarounds
Restrict IIS Log File Access
windowsApply strict file system permissions to IIS log directories to prevent unauthorized access.
icacls "C:\inetpub\logs\LogFiles" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /T
Enable Log File Encryption
windowsUse Windows EFS or third-party encryption to protect log files containing sensitive data.
cipher /e /s:"C:\inetpub\logs\LogFiles"
🧯 If You Can't Patch
- Implement strict access controls on IIS log directories to prevent unauthorized access.
- Regularly monitor and audit access to IIS log files for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check C•CURE 9000 Web Server version in application interface or configuration files; versions prior to 3.10.0 are vulnerable.Check Version:
Check C•CURE 9000 Web Server version through the application admin interface or configuration files.Verify Fix Applied:
Verify installation of version 3.10.0 and check that Windows credentials are no longer logged in IIS logs during normal operation.📡 Detection & Monitoring
Log Indicators:
- Windows credential strings appearing in IIS log files
- Unauthorized access attempts to IIS log directories
Network Indicators:
- Unusual file access patterns to log directories from non-admin accounts
SIEM Query:
EventID=4663 AND ObjectName LIKE '%LogFiles%' AND AccessMask='0x10000' AND SubjectUserName NOT IN ('SYSTEM', 'Administrators')🔗 References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-03
- https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-03
- https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf
