CVE-2024-55210
📋 TL;DR
This vulnerability allows attackers to bypass multi-factor authentication in TOTVS Framework (Linha Protheus) by sending specially crafted websocket messages. Systems running the affected version are vulnerable to unauthorized access. This affects organizations using TOTVS Protheus ERP software.
💻 Affected Systems
- TOTVS Framework (Linha Protheus)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to bypass all authentication controls, access sensitive business data, and potentially execute arbitrary code with administrative privileges.
Likely Case
Unauthorized access to business applications and data, potentially leading to data theft, financial fraud, or business disruption.
If Mitigated
Limited impact if proper network segmentation, monitoring, and additional authentication layers are in place to detect and block unauthorized access attempts.
🎯 Exploit Status
Public proof-of-concept code is available on GitHub, making exploitation trivial for attackers with basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact TOTVS support for guidance. Consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Disable WebSocket functionality
allDisable WebSocket support in TOTVS Protheus configuration to prevent exploitation via this vector
Modify Protheus configuration files to disable WebSocket protocol support
Network segmentation and filtering
linuxRestrict access to WebSocket ports (typically 8080, 8443) using firewall rules
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 8443 -j DROP
🧯 If You Can't Patch
- Implement additional authentication layers (WAF, reverse proxy with authentication)
- Monitor WebSocket traffic for anomalous authentication bypass patterns
🔍 How to Verify
Check if Vulnerable:
Check if running TOTVS Protheus version 12.1.2310 and test WebSocket authentication bypass using available PoCCheck Version:
Check Protheus version in application interface or configuration filesVerify Fix Applied:
Test authentication with MFA enabled - successful bypass indicates still vulnerable📡 Detection & Monitoring
Log Indicators:
- Failed MFA attempts followed by successful authentication
- WebSocket authentication anomalies
- Unusual authentication patterns from single IP
Network Indicators:
- WebSocket traffic bypassing normal authentication flow
- Abnormal WebSocket message patterns
SIEM Query:
source="protheus_logs" AND (event="authentication" AND result="success" AND mfa="bypassed")