CVE-2024-5354
📋 TL;DR
This vulnerability in anji-plus AJ-Report allows remote attackers to access sensitive information by manipulating the shareToken parameter in the /reportShare/detailByCode endpoint. It affects all users running AJ-Report versions up to 1.4.1. The information disclosure could expose report data that should be protected.
💻 Affected Systems
- anji-plus AJ-Report
📦 What is this software?
Aj Report by Anji Plus
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access all shared reports and sensitive data contained within them, potentially exposing confidential business information or personal data.
Likely Case
Unauthorized access to specific reports that were intended to be shared with limited audiences, leading to data exposure.
If Mitigated
Limited exposure of non-critical report data if proper access controls and network segmentation are in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues and PDF documents. Simple parameter manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2 or later
Vendor Advisory: https://github.com/anji-plus/report/issues/34
Restart Required: Yes
Instructions:
1. Upgrade AJ-Report to version 1.4.2 or later. 2. Restart the AJ-Report service. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or reverse proxy to block access to /reportShare/detailByCode
# Example nginx location block
location /reportShare/detailByCode { return 403; }
Implement rate limiting
linuxAdd rate limiting to the vulnerable endpoint to reduce brute force attempts
# Example using fail2ban or similar tools
🧯 If You Can't Patch
- Implement network segmentation to isolate AJ-Report from untrusted networks
- Add authentication requirements for accessing shared reports
🔍 How to Verify
Check if Vulnerable:
Test if you can access /reportShare/detailByCode with manipulated shareToken parameters and receive unauthorized data.Check Version:
Check the AJ-Report version in the application interface or configuration files.Verify Fix Applied:
After patching, attempt the same exploit and verify you receive proper access denied responses.📡 Detection & Monitoring
Log Indicators:
- Multiple failed or unusual requests to /reportShare/detailByCode
- Unusual parameter values in shareToken field
Network Indicators:
- Unusual traffic patterns to the vulnerable endpoint
- Multiple requests with varying shareToken parameters
SIEM Query:
source="web_server" AND uri="/reportShare/detailByCode" AND (param.shareToken="*" OR status=200)🔗 References
- https://github.com/anji-plus/report/files/15363269/aj-report.pdf
- https://github.com/anji-plus/report/issues/34
- https://vuldb.com/?ctiid.266266
- https://vuldb.com/?id.266266
- https://github.com/anji-plus/report/files/15363269/aj-report.pdf
- https://github.com/anji-plus/report/issues/34
- https://vuldb.com/?ctiid.266266
- https://vuldb.com/?id.266266
