9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-57190

CVE-2024-57190: Erxes Incorrect Access Control vulnerability

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-57190

CVE-2024-57190:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
erxes	npm	< 1.6.1	1.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-57190) in Erxes <1.6.1 allows an attacker to bypass authentication by providing a User HTTP header. This header was improperly trusted by the application to determine the user's identity.

The analysis of the patch 4ed2ca797241d2ba0c9083feeadd9755c1310ce8 reveals two key areas of modification:

Header Stripping in Middleware:
- The userMiddleware function in packages/gateway/src/middlewares/userMiddleware.ts was modified to explicitly delete the req.headers['user']. This indicates that, prior to the patch, this middleware did not sanitize this header, allowing it to be processed or passed through, leading to the authentication bypass.
- Additionally, a new, unnamed middleware was added at the entry point in packages/gateway/src/index.ts to also delete this header. This is a broader fix ensuring the header is removed early in the request lifecycle.
Defensive Check in GraphQL Resolver:
- The currentUser GraphQL resolver in packages/core/src/data/resolvers/queries/users.ts was modified to add a type check for user._id before using it. This suggests that this resolver could receive a user object (derived from the malicious header) with an improperly structured _id, and previously, it would attempt to use this potentially unsafe data directly.

The root cause is the failure to treat the User HTTP header as untrusted input. The userMiddleware is identified as a vulnerable function because it was a key component in the request handling chain that should have addressed this header but didn't. The currentUser resolver is identified as vulnerable because it consumed the user context that could be tainted by this header, leading to unauthorized data access.

During exploitation, an attacker would send a request with a crafted User header. The userMiddleware (in its vulnerable state) would fail to remove or validate this header. Subsequently, when a GraphQL query like currentUser is executed, the resolver would operate based on the fraudulent user identity provided by the attacker, leading to an incorrect access control scenario.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.