Multiple Vulnerabilities in Badger Meter's Monitool

Vulnerability

CVE-2024-1302 is an information exposure vulnerability in Badger Meter Monitool versions up to 4.6.3 and earlier [1]. By manipulating the application's file parameter to point to a log file, a local attacker can obtain sensitive information such as database credentials [1]. The vulnerability is classified as CWE-200 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) [1].

Exploitation

An attacker with local access to the Monitool application can change the value of the file parameter, typically used for legitimate file operations, to reference a log file on the system [1]. The attacker must be authenticated (PR:L) and requires user interaction (UI:R) to trigger the request, likely through a crafted file operation within the application interface [1]. No network-based remote exploitation is described; the attack vector is network (AV:N) as the application is web-based, but local access to the system or an authenticated session is needed [1].

Impact

On success, the attacker can read the contents of arbitrary log files, which often contain database credentials, session tokens, or other secrets [1]. This leads to disclosure of confidential information (C:H) and may allow further compromise through credential reuse (I:H) [1]. The confidentiality and integrity impacts are high, but availability is not affected (A:N) [1].

Mitigation

The vulnerability has been fixed in Monitool version 4.7 and later [1]. Users running any version up to 4.6.3 should upgrade to version 4.7 or newer as soon as possible [1]. No alternative workarounds are mentioned in the available references [1]. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication date [1].