CVE-2024-13109
📋 TL;DR
This vulnerability allows unauthorized access to the /doc.html endpoint in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Attackers can remotely exploit this improper authorization flaw to access sensitive documentation or potentially other system resources. Organizations using this specific version of the examination system are affected.
💻 Affected Systems
- Beijing Yunfan Internet Technology Yunfan Learning Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation or access to sensitive administrative interfaces, potentially leading to data theft, system manipulation, or further network penetration.
Likely Case
Unauthorized access to system documentation, configuration details, or internal APIs that could facilitate further attacks or information disclosure.
If Mitigated
Limited information disclosure with no direct path to critical systems or data due to proper network segmentation and access controls.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider workarounds.
🔧 Temporary Workarounds
Block /doc.html endpoint
allUse web server configuration or WAF to block access to the vulnerable endpoint
# Apache: RewriteRule ^/doc\.html$ - [F,L]
# Nginx: location = /doc.html { deny all; }
# IIS: Add request filtering rule
Network segmentation
linuxRestrict access to the examination system to authorized users only
# Firewall rule example: iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
# iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[system-ip]/doc.html without authentication. If accessible, system is vulnerable.Check Version:
Check system documentation or web interface footer for version informationVerify Fix Applied:
After applying workarounds, verify /doc.html endpoint returns 403/404 or is inaccessible.📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to /doc.html from unauthorized IPs
- Unusual access patterns to documentation endpoints
Network Indicators:
- HTTP GET requests to /doc.html from unexpected sources
- Traffic spikes to documentation endpoints
SIEM Query:
source="web_server" AND (uri_path="/doc.html" OR uri_path="/doc") AND response_status=200🔗 References
- https://github.com/qiutiandefeng/yfexam-exam/issues/4
- https://github.com/qiutiandefeng/yfexam-exam/issues/4#issue-2754670219
- https://vuldb.com/?ctiid.289925
- https://vuldb.com/?id.289925
- https://vuldb.com/?submit.467695
- https://github.com/qiutiandefeng/yfexam-exam/issues/4
- https://github.com/qiutiandefeng/yfexam-exam/issues/4#issue-2754670219
