CVE-2024-50693
Published: 26 February 2025
Summary
CVE-2024-50693 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Sungrowpower Isolarcloud. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for all logical access to user objects via the userService API, directly preventing IDOR exploitation by unauthenticated attackers manipulating object references.
Implements a reference monitor that mediates access to user objects, ensuring direct object references in API requests are checked against access policies to block unauthorized access.
Validates manipulated ID parameters in userService API requests to reject unauthorized or malformed object references, addressing one aspect of IDOR exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote IDOR in public-facing web API directly enables exploitation of the application for unauthorized data access/modification.
NVD Description
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model.
Deeper analysisAI
SunGrow iSolarCloud, prior to its remediation on October 31, 2024, contains a vulnerability classified as CVE-2024-50693, stemming from insecure direct object references (IDOR) in the userService API model (CWE-639). This flaw has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high confidentiality and integrity impacts without requiring authentication or user interaction.
Remote, unauthenticated attackers can exploit this IDOR vulnerability over the network with low complexity to access or manipulate unauthorized user objects via manipulated API requests to the userService endpoint. Successful exploitation enables attackers to read sensitive user data or alter user information, compromising confidentiality and integrity across the affected iSolarCloud instances.
Sungrow has issued a security notice detailing the issue and remediation, available at https://en.sungrowpower.com/security-notice-detail-2/6120. Organizations should apply the October 31, 2024 patch or later to mitigate the vulnerability.
Details
- CWE(s)