CVE-2024-27453

Read-only user can escalate to root via crafted HTTP POST in MMI.

• CVSS 8.6
• CWE-266
• Authorization, Authentication, and Session Management
• Remote

In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).

CVE

CVE-2024-27453

CWE

CWE-266

CVSS base score

8.6

Published

2024-05-03

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authorization, Authentication, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Privilege Escalation

Affected component

Extreme XOS

Solution

Upgrade to Extreme XOS version 22.6.2 or later.

from flask import Flask, request

app = Flask(__name__)

@app.route('/mmi', methods=['POST'])
def mmi_method():
    return "Action performed successfully", 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort

app = Flask(__name__)

USER_ROLES = {
    'readonly_user': 'read-only',
    'admin_user': 'admin'
}

def check_permissions(user):
    if USER_ROLES.get(user) != 'admin':
        abort(403)

@app.route('/mmi', methods=['POST'])
def mmi_method():
    user = request.headers.get('X-User ')
    check_permissions(user)

    return "Action performed successfully", 200

if __name__ == '__main__':
    app.run()

{
    "command": "escalate_privileges",
    "target": "root"
}

@misc{vaitp:cve202427453,
  title        = {{Read-only user can escalate to root via crafted HTTP POST in MMI.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-27453},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-27453/}}
}