Cyber Posture

CVE-2024-57032

CriticalPublic PoC

Published: 17 January 2025

Published
17 January 2025
Modified
19 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0057 68.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-57032 is an incorrect access control vulnerability in WeGIA versions prior to 3.2.0, specifically within the controle/control.php component. The flaw arises because the application does not properly validate the value provided in the 'senha_antiga' (old password) field during password change operations. This allows arbitrary password modifications without knowledge of the existing password. The issue is associated with CWE-863 (Incorrect Authorization) and CWE-284 (Improper Access Control), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By submitting a crafted request to controle/control.php with any value in the senha_antiga field, attackers can change the password of any user account, potentially compromising administrative privileges and leading to high impacts on confidentiality, integrity, and availability.

Mitigation involves upgrading to WeGIA 3.2.0 or later, as versions prior to this release remain vulnerable. Further technical details and reproduction steps are documented in the vulnerability research repository at https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-57032, with additional information available on the official WeGIA site at https://www.wegia.org/.

Details

CWE(s)
CWE-863CWE-284

Affected Products

wegia
wegia
≤ 3.2.0

MITRE ATT&CK Enterprise Techniques

T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Incorrect access control in the password change functionality enables unauthorized account manipulation (T1098) by allowing password changes without validating the old password, exploited via a public-facing web application (T1190).

References