CVE-2024-10965
📋 TL;DR
This vulnerability in EMQX Neuron up to version 2.10.0 allows remote attackers to access sensitive information through the /api/v2/schema endpoint of the JSON File Handler component. The information disclosure could expose internal system details or configuration data. Organizations running vulnerable versions of EMQX Neuron are affected.
💻 Affected Systems
- EMQX Neuron
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain sensitive configuration data, API schemas, or internal system information that could facilitate further attacks or reconnaissance.
Likely Case
Unauthorized access to API schema information that could reveal system structure and potentially aid in discovering other vulnerabilities.
If Mitigated
Limited exposure with proper network segmentation and access controls, though information disclosure still occurs.
🎯 Exploit Status
Remote exploitation requires network access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit c9ce39747e0372aaa2157b2b56174914a12c06d8
Vendor Advisory: https://github.com/emqx/neuron/issues/2281
Restart Required: Yes
Instructions:
1. Update to EMQX Neuron version containing commit c9ce39747e0372aaa2157b2b56174914a12c06d8
2. Restart the Neuron service
3. Verify the patch is applied by checking the version
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the /api/v2/schema endpoint using firewall rules or network segmentation
iptables -A INPUT -p tcp --dport [NEURON_PORT] -m string --string "/api/v2/schema" --algo bm -j DROP
Reverse Proxy Filtering
allConfigure reverse proxy to block requests to the vulnerable endpoint
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure of the Neuron API endpoints
- Monitor access logs for suspicious requests to /api/v2/schema endpoint
🔍 How to Verify
Check if Vulnerable:
Check if running EMQX Neuron version 2.10.0 or earlier and test access to http://[neuron_host]:[port]/api/v2/schemaCheck Version:
Check Neuron version in web interface or configuration filesVerify Fix Applied:
Verify the commit c9ce39747e0372aaa2157b2b56174914a12c06d8 is present in the installation or test that /api/v2/schema endpoint no longer discloses information📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to GET /api/v2/schema requests
- Unusual access patterns to schema endpoint
Network Indicators:
- HTTP requests to /api/v2/schema from unexpected sources
SIEM Query:
source="neuron" AND (url="/api/v2/schema" OR path="/api/v2/schema")