CVE-2024-50693
📋 TL;DR
This vulnerability allows attackers to bypass authorization controls in SunGrow iSolarCloud's userService API, enabling unauthorized access to other users' data and potentially administrative functions. All SunGrow iSolarCloud installations before the October 31, 2024 remediation are affected.
💻 Affected Systems
- SunGrow iSolarCloud
📦 What is this software?
Isolarcloud by Sungrowpower
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the solar monitoring system, allowing attackers to manipulate solar farm operations, steal sensitive customer data, or disrupt energy production.
Likely Case
Unauthorized access to other users' solar production data, billing information, and personal details through IDOR manipulation.
If Mitigated
Limited impact with proper API authentication and authorization controls in place, restricting access to authorized resources only.
🎯 Exploit Status
Requires some authentication but can bypass authorization checks to access other users' resources
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after October 31, 2024 remediation
Vendor Advisory: https://en.sungrowpower.com/security-notice-detail-2/6120
Restart Required: Yes
Instructions:
1. Contact SunGrow support for the latest patched version. 2. Backup current configuration. 3. Apply the patch provided by SunGrow. 4. Restart the iSolarCloud service. 5. Verify the fix is applied.
🔧 Temporary Workarounds
API Access Restriction
allRestrict access to the userService API endpoints to authorized users only
Network Segmentation
allIsolate iSolarCloud systems from untrusted networks
🧯 If You Can't Patch
- Implement strict API authentication and authorization middleware
- Deploy a web application firewall (WAF) with IDOR protection rules
🔍 How to Verify
Check if Vulnerable:
Test if you can access other users' data by manipulating object IDs in userService API requestsCheck Version:
Check iSolarCloud admin interface for version information or contact SunGrow supportVerify Fix Applied:
Verify that object ID manipulation no longer allows access to unauthorized resources📡 Detection & Monitoring
Log Indicators:
- Unusual API access patterns
- Multiple failed authorization attempts followed by successful access
- Access to user IDs outside normal range
Network Indicators:
- Unusual traffic to userService API endpoints
- Requests with manipulated object IDs
SIEM Query:
source="iSolarCloud" AND (uri="*/userService/*" AND status=200) AND user_id NOT IN authorized_users