CVE-2024-55062
📋 TL;DR
This is a critical code injection vulnerability in EasyVirt DCScope and CO2Scope that allows remote unauthenticated attackers to execute arbitrary code via the /api/license/sendlicense/ endpoint. Attackers can gain complete control of affected systems without any authentication. All organizations running vulnerable versions of these products are at risk.
💻 Affected Systems
- EasyVirt DCScope
- EasyVirt CO2Scope
📦 What is this software?
Co2scope by Easyvirt
Dcscope by Easyvirt
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, lateral movement within the network, and persistent backdoor installation.
Likely Case
Initial foothold for attackers leading to credential harvesting, data exfiltration, and deployment of additional malware payloads.
If Mitigated
Attack blocked at network perimeter or application firewall, with no successful exploitation despite attempts.
🎯 Exploit Status
The vulnerability requires sending specially crafted requests to the /api/license/sendlicense/ endpoint. No authentication is required, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: DCScope > 8.6.0, CO2Scope > 1.3.0
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Check current version using product's version command. 2. Contact EasyVirt support for patched versions. 3. Apply updates following vendor's upgrade procedures. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or network controls to block access to /api/license/sendlicense/ endpoint
# Example iptables rule: iptables -A INPUT -p tcp --dport [PORT] -m string --string "/api/license/sendlicense/" --algo bm -j DROP
Network segmentation
allIsolate affected systems from internet and restrict access to trusted networks only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the vulnerable endpoint
- Deploy web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if system responds to requests at /api/license/sendlicense/ endpoint and verify version is within vulnerable rangeCheck Version:
Check product documentation for version command (typically via web interface or configuration files)Verify Fix Applied:
Test that /api/license/sendlicense/ endpoint no longer accepts malicious payloads and verify updated version📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /api/license/sendlicense/ endpoint
- Suspicious process creation or command execution following license API calls
- Failed authentication attempts not present for this endpoint
Network Indicators:
- Unusual outbound connections from affected systems
- Traffic patterns indicating command and control communication
- Unexpected data exfiltration
SIEM Query:
source="web_logs" AND uri="/api/license/sendlicense/" AND (payload CONTAINS "system" OR payload CONTAINS "exec" OR payload CONTAINS "cmd")