External risk intelligence

ProPhoenix Law RMS API Access Control Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-34320

The product is a specialized Records Management System (RMS) for law enforcement. While it may utilize network-accessible APIs, these systems are typically deployed within secure, restricted government or agency networks rather than being exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ProPhoenix Law RMS software, specifically concerning the access control of sensitive API endpoints. This issue could potentially allow unauthorized access to protected data and system functionalities. The primary concern at this time is to confirm whether this specific software is in use within our environment and, if so, to understand the scope of potential exposure.

Flaw allows unauthorized access to sensitive data.
Confirm if ProPhoenix Law RMS is in use.
Assess potential exposure and relevant risks.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach sensitive API endpoints within ProPhoenix Law RMS if those endpoints are exposed to the network. Without needing any credentials, the attacker could then interact with these endpoints, leading to unauthorized access, modification, or destruction of data.

Network exposure of API endpoints.
Directly calling sensitive API endpoints.
Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to access sensitive information and potentially alter system behavior by exploiting incorrect access controls in the ProPhoenix Law RMS API. When supported by the advisory, this could affect system data and service operations.

System data and service behavior.
Exploits an API's incorrect access control.
Unauthorized access and data alteration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ProPhoenix Law RMS affects sensitive API endpoints, indicating potential ownership by teams managing applications, their underlying infrastructure, or specialized platform teams responsible for the Records Management System itself. The initial step is to locate all instances of ProPhoenix Law RMS, determine their network exposure, confirm business criticality, and identify the specific accountable owner for each deployment before planning remediation.

Application and infrastructure teams own the issue.
Verify API endpoint reachability and criticality.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ProPhoenix Law RMS?

ProPhoenix Law RMS is a Records Management System designed for law enforcement agencies. It serves as a centralized platform for managing sensitive public safety and administrative data. Agencies rely on this software to organize case files, incident reports, and other critical records required for daily operations.

What does CWE-284 mean for CVE-2024-34320?

CWE-284 refers to Improper Access Control. In the context of this CVE, it means the software's API endpoints fail to properly verify who is allowed to interact with them. Because these protections are missing, an unauthorized user can reach and manipulate sensitive data or system functions that should have been restricted.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending direct, unauthenticated requests to vulnerable API endpoints within the software. The vulnerability does not require the attacker to have a valid login or perform any special setup. It is not triggered by standard, authorized user interactions, but rather by specifically targeting these improperly secured API paths.

Is my organization at risk from this API issue?

Risk depends on your deployment. Halo Surface Signal notes that while this software uses network-accessible APIs, it is typically housed within restricted agency or government networks. If your instance is isolated from the public internet, the attack surface is significantly smaller than if these API endpoints are reachable from outside your secure perimeter.

How should I respond to CVE-2024-34320?

Begin by identifying all servers running ProPhoenix Law RMS in your environment. Once located, verify if any API endpoints are accessible over the network. Confirm the business criticality of each instance and coordinate with the infrastructure or application teams who manage these systems to evaluate the necessity of those network connections and prepare for forthcoming remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.