CVE-2024-56086
📋 TL;DR
Authenticated users in Logpoint versions before 7.5.0 can inject malicious payloads into Report Templates. When backups are initiated, these payloads execute, allowing remote code execution on the Logpoint server. This affects all organizations using vulnerable Logpoint versions with authenticated user accounts.
💻 Affected Systems
- Logpoint
📦 What is this software?
Siem by Logpoint
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code with the privileges of the Logpoint service, potentially leading to data theft, lateral movement, or complete system takeover.
Likely Case
Privilege escalation from authenticated user to system-level access, enabling data exfiltration, installation of persistence mechanisms, or disruption of security monitoring.
If Mitigated
Limited impact if proper access controls restrict template creation to trusted administrators only and backups are monitored.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of template injection techniques. The vulnerability is in the backup process triggered by administrators.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.5.0
Vendor Advisory: https://servicedesk.logpoint.com/hc/en-us/articles/22136886421277-Remote-Code-Execution-while-creating-Report-Templates
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download Logpoint 7.5.0 from official sources. 3. Follow Logpoint upgrade documentation for your deployment type. 4. Verify successful upgrade and functionality.
🔧 Temporary Workarounds
Restrict Template Creation
allLimit report template creation and modification to trusted administrators only using role-based access controls.
Monitor Backup Activities
allImplement strict monitoring and alerting for backup initiation and template modifications.
🧯 If You Can't Patch
- Implement strict access controls to limit who can create or modify report templates
- Disable or restrict backup functionality to essential administrators only
🔍 How to Verify
Check if Vulnerable:
Check Logpoint version via web interface or command line. If version is below 7.5.0, the system is vulnerable.Check Version:
Check web interface dashboard or consult Logpoint documentation for version check commands specific to your deployment.Verify Fix Applied:
After upgrading, confirm version is 7.5.0 or higher and test report template functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual report template modifications
- Suspicious backup process initiation
- Unexpected system command execution
Network Indicators:
- Unusual outbound connections from Logpoint server following backups
SIEM Query:
source="logpoint" AND (event_type="template_modification" OR event_type="backup_initiated") AND user NOT IN ["trusted_admins"]