CVE-2024-10200

Executive Summary

CVE-2024-10200 is a critical Path Traversal vulnerability affecting the Wellchoose Administrative Management System. This flaw allows an unauthenticated remote attacker to download arbitrary files from the server by manipulating file path parameters. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. No public proof-of-concept (PoC) code or exploit templates have been identified at this time, but the risk of data exfiltration is significant. Organizations using this system should immediately implement mitigations and monitor for suspicious file access patterns.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of remote, unauthenticated access with high confidentiality impact makes this a critical risk for data breaches.

Deep Dive & Mechanics

The vulnerability resides in the file download functionality of the Wellchoose Administrative Management System. The application fails to properly sanitize user-supplied input used to construct file paths. By injecting path traversal sequences (e.g., ../), an attacker can escape the intended directory and read arbitrary files from the server's filesystem.

Attack Flow:

1. The attacker identifies a download endpoint that accepts a filename or path parameter.
2. The attacker crafts a request with a path traversal payload, such as ../../../../etc/passwd.
3. The server processes the request without validation, returning the contents of the target file.
4. The attacker can then exfiltrate sensitive data, including configuration files, credentials, or application source code.

Potential Impact:

• Exposure of database credentials and API keys.
• Leakage of proprietary business logic and source code.
• Disclosure of system configuration files (e.g., /etc/passwd, /etc/shadow).
• Potential pivot to further attacks using gathered intelligence.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Conceptual):

$file = $_GET['file'];
$path = '/var/www/uploads/' . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}

Patched Code (Conceptual):

$file = basename($_GET['file']);
$path = realpath('/var/www/uploads/' . $file);
if (strpos($path, realpath('/var/www/uploads/')) === 0 && file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}

The patched version uses basename() to strip directory components and realpath() to resolve the full path, then verifies it starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Deploy a vulnerable instance of Wellchoose Administrative Management System (version unknown).
• Use a tool like Burp Suite or curl to interact with the application.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /download.php?file=).
2. Test with a simple traversal: ../../../../etc/passwd.
3. If successful, retrieve sensitive files:

   curl "http://target.com/download.php?file=../../../../etc/passwd"
   

4. Automate with a script to enumerate common files:

   for file in /etc/passwd /etc/shadow /var/www/html/config.php; do
       curl -o "$(basename $file)" "http://target.com/download.php?file=../../../../$file"
   done
   

Note: No public exploit code is available; this is a generic demonstration.

Blue Team (Defensive)

Detection & Response:

• Monitor web server logs for requests containing ../ or ..%2f patterns.
• Alert on attempts to access system files (e.g., /etc/passwd, /etc/shadow).
• Implement a Web Application Firewall (WAF) rule to block path traversal sequences.
• Conduct regular file integrity checks on sensitive system files.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="*/download.php*" uri_query="*file=*../*"
| stats count by src_ip, uri

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with ../ or ..%2f in the file parameter.
  • Outbound connections from the server to unknown IPs after file download.
• File IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or application config files.
  • Presence of downloaded files in temporary directories.
• Log IOCs:
  • Web server logs showing 404 or 200 responses for path traversal attempts.
  • Error logs indicating file inclusion failures.

Detection Engineering

YARA Rule

rule CVE_2024_10200_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting Wellchoose Administrative Management System"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-10200"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $target = "/download.php"
    condition:
        any of ($traversal*) and $target
}

Sigma Rule

title: CVE-2024-10200 Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in HTTP requests to Wellchoose Administrative Management System
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
        cs-uri-stem|endswith: '/download.php'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10200 Path Traversal Attempt"; flow:to_server,established; content:"/download.php"; http_uri; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If possible, disconnect the Wellchoose Administrative Management System from the network until a patch is applied.
2. WAF Rules: Deploy a Web Application Firewall with rules to block path traversal patterns (e.g., ../, ..%2f).
3. Input Validation: Implement server-side validation to reject any file path containing ../ or similar sequences.
4. Least Privilege: Ensure the web server runs with minimal file system permissions, limiting access to only necessary directories.

Long-Term Fixes:

• Vendor Patch: Await an official patch from Wellchoose. Contact the vendor for an ETA.
• Code Hardening: If source code is available, apply the patched code pattern shown in the "Vulnerable vs. Patched Code" section.
• Regular Audits: Conduct periodic security reviews and penetration tests on the application.

Workaround:

• Disable the file download functionality entirely if not critical to business operations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert