CVE-2024-26480
📋 TL;DR
CVE-2024-26480 is an information disclosure vulnerability in Statping-ng v0.91.0 that allows attackers to access sensitive information through crafted requests to the admin parameter. This affects all systems running the vulnerable version of Statping-ng, a self-hosted status page monitoring tool. Attackers can potentially obtain administrative credentials or other confidential data.
💻 Affected Systems
- Statping-ng
📦 What is this software?
Statping Ng by Statping Ng
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Statping-ng instance with administrative access, allowing attackers to modify monitoring configurations, inject malicious content, or pivot to other systems.
Likely Case
Exposure of sensitive configuration data, API keys, or authentication tokens that could lead to unauthorized access or data manipulation.
If Mitigated
Limited information disclosure with no critical impact if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Proof of concept code is available on GitHub. Exploitation appears straightforward via crafted HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after v0.91.0
Vendor Advisory: https://github.com/statping-ng/statping-ng
Restart Required: Yes
Instructions:
1. Check current version with 'statping version'. 2. Update to latest version using package manager or download from GitHub. 3. Restart Statping-ng service.
🔧 Temporary Workarounds
Restrict Admin Parameter Access
allImplement web application firewall rules or reverse proxy configurations to block or sanitize requests to the admin parameter.
# Example nginx location block to restrict admin access
location ~* /admin {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network access controls to limit Statping-ng access to trusted IP addresses only.
- Monitor and alert on unusual requests to admin endpoints in application logs.
🔍 How to Verify
Check if Vulnerable:
Check if running Statping-ng version 0.91.0 using 'statping version' or by examining the application interface.Check Version:
statping versionVerify Fix Applied:
Confirm version is updated beyond v0.91.0 and test that crafted requests to admin parameter no longer return sensitive information.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests containing crafted admin parameter values
- Multiple failed authentication attempts following information disclosure
Network Indicators:
- HTTP requests with unusual parameters to admin endpoints
- Traffic patterns showing reconnaissance of admin interfaces
SIEM Query:
source="statping-ng" AND (uri="*admin*" OR method="POST" AND status=200 AND size>1000)