CVE-2024-29841
📋 TL;DR
The Evolution Controller web interface contains an access control vulnerability in the DESKTOP_EDIT_USER_GET_KEYS_FIELDS endpoint that allows unauthenticated attackers to retrieve sensitive keys data for any user. This affects Evolution Controller versions 2.04.560.31.03.2024 and below. Organizations using these vulnerable versions are at risk of unauthorized data exposure.
💻 Affected Systems
- Evolution Controller
📦 What is this software?
Evolution by Cs Technologies
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain administrative credentials or cryptographic keys, leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Attackers harvest user keys and credentials to gain unauthorized access to user accounts and sensitive systems.
If Mitigated
With proper network segmentation and access controls, impact is limited to the exposed web interface component.
🎯 Exploit Status
The vulnerability requires no authentication and appears to be a simple API endpoint misconfiguration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Contact Evolution Controller vendor for patching information. 2. Monitor vendor communications for security updates. 3. Apply patches immediately when available.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the Evolution Controller web interface using firewall rules.
Web Application Firewall
allDeploy a WAF to block requests to the vulnerable DESKTOP_EDIT_USER_GET_KEYS_FIELDS endpoint.
🧯 If You Can't Patch
- Isolate the Evolution Controller system from untrusted networks and internet access
- Implement strict network segmentation and monitor for unusual access patterns to the web interface
🔍 How to Verify
Check if Vulnerable:
Attempt unauthenticated HTTP GET request to the DESKTOP_EDIT_USER_GET_KEYS_FIELDS endpoint and check if user keys are returned.Check Version:
Check Evolution Controller web interface version in administration panel or configuration files.Verify Fix Applied:
Verify the endpoint now requires proper authentication or returns appropriate access denied responses.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to DESKTOP_EDIT_USER_GET_KEYS_FIELDS endpoint
- Multiple failed authentication attempts followed by successful key retrieval
Network Indicators:
- Unusual HTTP traffic patterns to the Evolution Controller web interface
- Requests to sensitive endpoints without authentication headers
SIEM Query:
source="evolution_controller" AND (uri="/DESKTOP_EDIT_USER_GET_KEYS_FIELDS" OR status=200) AND NOT auth_token=*