CVE-2024-50687
📋 TL;DR
SunGrow iSolarCloud versions before October 31, 2024 contain an insecure direct object reference (IDOR) vulnerability in the devService API model. This allows attackers to access or manipulate data belonging to other users without proper authorization. All users of affected iSolarCloud systems are impacted.
💻 Affected Systems
- SunGrow iSolarCloud
📦 What is this software?
Isolarcloud by Sungrowpower
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user data, including sensitive solar system configurations, energy production data, and potentially access to control systems.
Likely Case
Unauthorized access to other users' solar system data, energy production information, and configuration details.
If Mitigated
Limited impact with proper API authentication and authorization controls in place.
🎯 Exploit Status
IDOR vulnerabilities typically require some level of access but are easy to exploit once discovered
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after October 31, 2024 remediation
Vendor Advisory: https://en.sungrowpower.com/security-notice-detail-2/6114
Restart Required: No
Instructions:
1. Access iSolarCloud admin interface
2. Check for and apply any available updates
3. Verify version is post-October 31, 2024 remediation
4. Test API endpoints for proper authorization
🔧 Temporary Workarounds
API Access Restriction
allTemporarily restrict access to devService API endpoints
Configure web application firewall to block /devService/* endpoints
Enhanced Monitoring
allImplement detailed logging and monitoring for API access patterns
Enable verbose API logging in iSolarCloud configuration
🧯 If You Can't Patch
- Implement strict API authentication and authorization checks at the application layer
- Deploy web application firewall with IDOR-specific rules and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Test devService API endpoints with different user IDs to check if unauthorized access is possibleCheck Version:
Check iSolarCloud admin interface for version information or last update dateVerify Fix Applied:
Verify that API endpoints properly validate user authorization and return appropriate access denied responses📡 Detection & Monitoring
Log Indicators:
- Multiple user IDs accessed from single session
- Unauthorized API calls to devService endpoints
- Access denied errors for legitimate users
Network Indicators:
- Unusual API call patterns to /devService/* endpoints
- Rapid sequential requests with different parameters
SIEM Query:
source="iSolarCloud" AND (uri_path="/devService/*" AND (response_code=403 OR user_id_changes>1))