CVE-2024-23687
📋 TL;DR
This vulnerability involves hard-coded credentials in FOLIO's mod-data-export-spring module, allowing unauthenticated attackers to access critical APIs, modify user data, change configurations including SSO settings, and manipulate financial data. It affects all systems running vulnerable versions of the module. The CVSS 9.1 score indicates critical severity.
💻 Affected Systems
- FOLIO mod-data-export-spring
📦 What is this software?
Mod Data Export Spring by Openlibraryfoundation
Mod Data Export Spring by Openlibraryfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including SSO takeover, user data manipulation, financial fraud, and configuration changes enabling persistent access.
Likely Case
Unauthorized data access and modification, potential financial manipulation, and configuration changes affecting system security.
If Mitigated
Limited impact if network segmentation and access controls prevent external access to vulnerable endpoints.
🎯 Exploit Status
Exploitation requires network access to the vulnerable module but no authentication. The hard-coded credentials are publicly documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.4 or 2.0.3
Vendor Advisory: https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3
Restart Required: Yes
Instructions:
1. Identify current version of mod-data-export-spring. 2. Upgrade to version 1.5.4 (for 1.x branch) or 2.0.3 (for 2.x branch). 3. Restart the FOLIO module. 4. Verify the fix by checking version and testing API access.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the mod-data-export-spring module using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport [module_port] -s [allowed_ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [module_port] -j DROP
API Gateway Protection
allPlace the module behind an API gateway or reverse proxy with authentication requirements.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable module from untrusted networks.
- Deploy a web application firewall (WAF) with rules to block unauthorized API access patterns.
🔍 How to Verify
Check if Vulnerable:
Check the module version via FOLIO admin interface or by querying the module's status endpoint. Compare against affected versions.Check Version:
curl -X GET http://[module_host]:[port]/admin/health | grep versionVerify Fix Applied:
After patching, verify the version is 1.5.4 or higher (for 1.x) or 2.0.3 or higher (for 2.x). Test that unauthenticated API access is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated API requests to mod-data-export-spring endpoints
- Failed authentication attempts using hard-coded credentials
- Unusual configuration changes or data export activities
Network Indicators:
- Unusual traffic patterns to mod-data-export-spring APIs from unauthorized sources
- API requests without authentication headers
SIEM Query:
source="mod-data-export-spring" AND (status="401" OR auth_method="none")🔗 References
- https://github.com/advisories/GHSA-vf78-3q9f-92g3
- https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446
- https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3
- https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3
- https://wiki.folio.org/x/hbMMBw
- https://github.com/advisories/GHSA-vf78-3q9f-92g3
- https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446
- https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3
- https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3
- https://wiki.folio.org/x/hbMMBw
