Listen to this Post
How the Mentioned CVE Works
The vulnerability CVE-2024-37087 is a missing authorization flaw in the DELMIA Apriso platform. It exists because the application does not correctly enforce privilege checks on specific HTTP requests. An unauthenticated, remote attacker can send a specially crafted network packet to a vulnerable Apriso server. This packet targets a specific component or endpoint that lacks proper access control. The server processes this request without verifying if the user is authorized to perform the action. Consequently, the attacker bypasses all authentication mechanisms. This grants them the same level of access as a privileged, authenticated user. The attacker can then interact with the application with elevated rights, allowing them to read, modify, or delete sensitive data and potentially disrupt manufacturing operations. The attack requires no user interaction and exploits the inherent lack of a permission verification step.
DailyCVE Form
Platform: DELMIA Apriso
Version: 2020-2025
Vulnerability : Missing Authorization
Severity: Critical
date: 2024
Prediction: Expected Patch Q3 2024
What Undercode Say:
`curl -X POST http://
`nc -lvnp 4444`
`”permissions”: []`
How Exploit:
Craft unauthorized HTTP POST request to internal API endpoints to access or modify application data without credentials.
Protection from this CVE
Apply vendor patch. Implement network segmentation. Enforce strict access controls.
Impact:
Unauthorized privileged access. Data manipulation and exfiltration. Operational disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
