CVE-2024-27770

Executive Summary

CVE-2024-27770 is a critical relative path traversal vulnerability (CWE-23) affecting Unitronics Unistream Unilogic versions prior to 1.35.227. This flaw allows an unauthenticated attacker to read arbitrary files on the device’s filesystem, potentially exposing sensitive configuration data, credentials, and operational parameters. With a CVSS score of 8.8, the vulnerability is remotely exploitable over the network without authentication, posing a severe risk to industrial control systems (ICS) and operational technology (OT) environments. No public proof-of-concept (PoC) or exploit code has been released, but the vulnerability is actively being monitored by threat intelligence sources.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects proprietary Unitronics firmware and software for their Unistream PLC and HMI product line.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation (no authentication, low complexity) and the severe impact on confidentiality, integrity, and availability. In an OT context, this could allow attackers to read critical system files, modify device behavior, or cause denial of service.

Deep Dive & Mechanics

The vulnerability resides in the Unilogic runtime environment used by Unitronics Unistream PLCs and HMIs. The software fails to properly sanitize user-supplied input when handling file path requests, allowing an attacker to traverse directories using ../ sequences. This enables reading files outside the intended web root or application directory.

Root Cause: The application does not validate or canonicalize file paths before accessing them. An attacker can send a crafted HTTP request with path traversal sequences to read arbitrary files, such as:

• Configuration files (e.g., config.xml, passwd)
• Credential stores
• System logs
• Firmware binaries

Attack Vector: The vulnerability is exploitable over the network via the device’s web interface or API endpoints that handle file operations. No authentication is required.

Impact: Successful exploitation can lead to:

• Disclosure of sensitive operational data
• Credential theft for further lateral movement
• Potential privilege escalation if credentials are obtained
• Full compromise of the device if combined with other vulnerabilities

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.227):

# Example of vulnerable file read function
def read_file(file_path):
    # No sanitization of file_path
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (1.35.227+):

import os

def read_file(file_path):
    # Sanitize and canonicalize the path
    safe_path = os.path.normpath(file_path)
    if not safe_path.startswith('/allowed/base/directory'):
        raise PermissionError("Access denied")
    with open(safe_path, 'r') as f:
        return f.read()

The patched version uses os.path.normpath() to resolve path traversal sequences and then checks that the resulting path is within an allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Unitronics Unistream device with Unilogic < 1.35.227
• Attacker machine with curl or Burp Suite

Exploitation Steps:

1. Identify the target device (e.g., via Shodan dork: "Unitronics Unistream" port:20256).
2. Send a crafted HTTP GET request to read sensitive files:

   curl "http://<target_ip>/../../../../etc/passwd"
   

3. If successful, the response will contain the contents of /etc/passwd.
4. Attempt to read configuration files:

   curl "http://<target_ip>/../../../../config.xml"
   

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing ../ or ..%2f patterns.
• Alert on attempts to access files outside the web root (e.g., /etc/passwd, /config.xml).
• Use network intrusion detection systems (NIDS) to flag path traversal attempts.

Mitigation:

• Immediately upgrade to Unilogic version 1.35.227 or later.
• If patching is not possible, restrict network access to the device using firewalls or VPNs.
• Implement web application firewall (WAF) rules to block path traversal patterns.
• Enable logging and monitor for anomalous file access requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..%2f in the URI path.
  • Requests to endpoints like /../../../../etc/passwd or /../../../../config.xml.
  • Unusual outbound connections from the device to unknown IPs.

• File IOCs:

  • Unexpected access to system files (e.g., /etc/passwd, /etc/shadow).
  • Modified configuration files or logs indicating unauthorized reads.

• System IOCs:

  • Unusual process activity or file access patterns on the device.
  • Presence of new user accounts or changes to existing credentials.

Detection Engineering

YARA Rule

rule CVE_2024_27770_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Unitronics Unistream devices"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-27770"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/config.xml"
        $sensitive3 = "/proc/self/"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-27770 Path Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting Unitronics Unistream devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27770 Path Traversal Attempt"; flow:to_server; content:"../"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-27770 Path Traversal Attempt (encoded)"; flow:to_server; content:"%2e%2e%2f"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Unilogic to version 1.35.227 or later. Contact Unitronics support for the update.
2. Restrict network access to the device using firewalls, ACLs, or VPNs. Only allow trusted IPs.
3. Disable unnecessary services and web interfaces if not required.

Long-Term Measures:

• Implement a web application firewall (WAF) with rules to block path traversal patterns.
• Conduct regular vulnerability scans and penetration tests on OT devices.
• Monitor logs for suspicious file access attempts.
• Follow the vendor’s security advisories and apply patches promptly.

Workarounds (if patching is delayed):

• Use network segmentation to isolate the device from untrusted networks.
• Enable authentication for all web interfaces (if supported).
• Deploy an IDS/IPS to detect and block exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert