CVE-2024-10173
📋 TL;DR
This vulnerability allows attackers to bypass authentication in didi DDMQ 1.0's Console Module by manipulating the /;login endpoint. Remote attackers can potentially gain unauthorized access to administrative functions. All systems running DDMQ 1.0 with the Console Module exposed are affected.
💻 Affected Systems
- didi DDMQ
📦 What is this software?
Ddmq by Didiglobal
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access, modify, or delete message queues, configuration data, and potentially execute arbitrary code on the underlying system.
Likely Case
Unauthorized access to administrative console leading to message queue manipulation, data exposure, and potential service disruption.
If Mitigated
Limited impact with proper network segmentation and authentication controls in place, potentially only exposing non-sensitive configuration data.
🎯 Exploit Status
Exploit has been publicly disclosed on GitHub and requires minimal technical skill to execute. The vulnerability involves simple URL manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Monitor the DDMQ GitHub repository for updates and apply any security patches when released.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the Console Module using firewall rules or network segmentation
iptables -A INPUT -p tcp --dport [CONSOLE_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [CONSOLE_PORT] -j DROP
Reverse Proxy Authentication
allPlace the Console Module behind a reverse proxy with additional authentication layer
🧯 If You Can't Patch
- Isolate the DDMQ Console Module to internal network segments only
- Implement Web Application Firewall (WAF) rules to block requests containing /;login patterns
🔍 How to Verify
Check if Vulnerable:
Attempt to access the Console Module login endpoint with /;login appended to the URL and check if authentication is bypassedCheck Version:
Check DDMQ documentation or configuration files for version information (specific command unavailable)Verify Fix Applied:
Test the same authentication bypass attempt after implementing workarounds to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Access to /;login endpoints
- Successful logins from unexpected IP addresses
Network Indicators:
- HTTP requests containing /;login in URL path
- Unauthorized access to console port
SIEM Query:
source="ddmq_logs" AND (url_path="/;login" OR auth_result="success" FROM unexpected_ip)