CVE-2024-29839
📋 TL;DR
The Evolution Controller web interface has an access control vulnerability in the DESKTOP_EDIT_USER_GET_CARD endpoint that allows unauthenticated attackers to retrieve card value data for any user. This affects Evolution Controller versions 2.04.560.31.03.2024 and below, exposing sensitive user information without authentication.
💻 Affected Systems
- Evolution Controller
📦 What is this software?
Evolution by Cs Technologies
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of all user card data leading to identity theft, financial fraud, and credential compromise across the entire user base.
Likely Case
Unauthorized access to sensitive user card information enabling targeted attacks, data harvesting, and potential credential reuse attacks.
If Mitigated
Limited to authenticated users only, restricting access to authorized personnel with proper access controls.
🎯 Exploit Status
Exploitation requires network access to web interface; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor vendor for security updates. 2. Apply patch when available. 3. Verify fix by testing endpoint access controls.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to Evolution Controller web interface to trusted networks only.
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port port="WEB_PORT" protocol="tcp" accept'
netsh advfirewall firewall add rule name="Block Evolution Web" dir=in action=block protocol=TCP localport=WEB_PORT remoteip=any
Web Application Firewall
allImplement WAF rules to block requests to DESKTOP_EDIT_USER_GET_CARD endpoint from unauthenticated sources.
# WAF-specific configuration varies by product
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Evolution Controller from untrusted networks.
- Deploy additional authentication layer (reverse proxy with authentication) in front of web interface.
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to DESKTOP_EDIT_USER_GET_CARD endpoint without authentication; if it returns user card data, system is vulnerable.Check Version:
Check web interface version in admin panel or via vendor documentation.Verify Fix Applied:
Attempt same request after remediation; should return authentication error or no data.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to DESKTOP_EDIT_USER_GET_CARD endpoint
- Multiple failed authentication attempts followed by successful card data retrieval
Network Indicators:
- HTTP GET requests to vulnerable endpoint from unauthenticated sources
- Unusual data exfiltration patterns from web interface
SIEM Query:
source="web_logs" AND uri="/DESKTOP_EDIT_USER_GET_CARD" AND auth_status="unauthenticated"