CVE-2024-27771

Executive Summary

CVE-2024-27771 is a critical path traversal vulnerability (CWE-22) affecting Unitronics Unistream Unilogic versions prior to 1.35.227. This flaw allows an unauthenticated attacker to traverse directories on the target system, potentially leading to remote code execution (RCE). With a CVSS score of 8.8, the vulnerability is highly exploitable over the network without requiring authentication or user interaction. The vendor has not released a public patch, and no proof-of-concept (PoC) code is currently available in public exploit databases. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the severity warrants immediate attention for organizations using affected versions.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects proprietary industrial control system (ICS) firmware from Unitronics.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file system read access.
• Integrity Impact: High (I:H) – Potential to modify files or execute code.
• Availability Impact: High (A:H) – Could lead to denial of service or system compromise.

Threat Level: Critical. The combination of network exploitability, no authentication, and potential for RCE makes this a high-priority vulnerability for ICS/SCADA environments.

Deep Dive & Mechanics

The vulnerability resides in the Unilogic runtime of Unitronics Unistream PLCs. The software fails to properly sanitize user-supplied input when handling file paths, allowing an attacker to use path traversal sequences (e.g., ../) to escape the intended directory. This can lead to reading arbitrary files on the device, including sensitive configuration files, credentials, or system binaries. In the worst case, an attacker could upload a malicious file (e.g., a modified firmware or script) to achieve remote code execution.

Attack Flow:

1. An attacker sends a crafted HTTP or proprietary protocol request to the Unistream device (typically on port 20256).
2. The request includes path traversal sequences in a file path parameter (e.g., ../../../etc/passwd).
3. The Unilogic runtime processes the request without validation, returning the contents of the traversed file.
4. If the attacker can write files (e.g., via a similar traversal in a write operation), they can upload a malicious payload and execute it.

Root Cause: Lack of input validation and missing canonicalization of file paths in the Unilogic firmware.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Unilogic firmware < 1.35.227
void handle_file_request(char *user_path) {
    char full_path[256];
    sprintf(full_path, "/data/files/%s", user_path); // No sanitization
    FILE *f = fopen(full_path, "r");
    if (f) {
        // Send file contents to client
    }
}

Patched Code (Conceptual):

// Unilogic firmware >= 1.35.227
void handle_file_request(char *user_path) {
    char full_path[256];
    // Canonicalize and validate path
    if (strstr(user_path, "..") != NULL || strchr(user_path, '/') != NULL) {
        // Reject request
        return;
    }
    snprintf(full_path, sizeof(full_path), "/data/files/%s", user_path);
    FILE *f = fopen(full_path, "r");
    if (f) {
        // Send file contents to client
    }
}

Note: The actual patch may involve additional checks, such as whitelisting allowed directories or using secure path resolution functions.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Unitronics Unistream device with Unilogic < 1.35.227.
• Network access to the device (port 20256 typically).
• No authentication required.

Exploitation Steps:

1. Scan for vulnerable devices: Use Shodan or Nmap to find Unitronics Unistream devices.

   nmap -p 20256 --script banner <target_ip>
   

2. Craft path traversal request: Send a request to read /etc/passwd (if Linux-based) or other sensitive files.

   curl "http://<target_ip>:20256/../../../etc/passwd"
   

3. Attempt RCE: If the device allows file uploads via path traversal, upload a malicious script.

   # Example: Upload a reverse shell script
   curl -X POST -F "file=@shell.sh" "http://<target_ip>:20256/../../../tmp/shell.sh"
   

4. Execute the uploaded file: Trigger execution via another endpoint or by overwriting a startup script.

Note: No public exploit code is available; the above is conceptual.

Blue Team (Defensive)

Detection:

• Monitor network traffic for path traversal patterns (e.g., ../, %2e%2e/).
• Look for unusual file access requests to sensitive system files.
• Use the detection rules provided in the Detection Engineering section.

Honeypot Setup:

• Deploy a honeypot mimicking Unitronics Unistream to capture attacker behavior.
• Log all requests to port 20256 and analyze for traversal attempts.

Mitigation:

• Immediately upgrade to Unilogic version 1.35.227 or later.
• If patching is not possible, restrict network access to the device using firewalls or VPNs.
• Disable unnecessary services and change default credentials.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or %2e%2e/ in the URI path.
  • Connections to port 20256 from unexpected external IPs.
  • Unusual file read requests (e.g., /etc/passwd, /etc/shadow, C:\Windows\System32\config\SAM).

• File System IOCs:

  • Presence of unexpected files in /tmp, /data/files, or other writable directories.
  • Modified system binaries or configuration files.

• Log IOCs:

  • Unilogic logs showing failed path validation attempts (if logging is enabled).
  • Repeated access to non-standard file paths.

Detection Engineering

YARA Rule

rule CVE_2024_27771_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Unitronics Unistream Unilogic"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-27771"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $traversal4 = "%2e%2e\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "boot.ini"
        $sensitive4 = "windows\\system32"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-27771 Path Traversal Attempt on Unitronics Unistream
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting Unitronics Unistream devices
author: Valters IT
date: 2024-10-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e/'
            - '%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate use of '..' in some applications (rare)
level: high

Suricata Rule

alert http any any -> any 20256 (msg:"CVE-2024-27771 Path Traversal Attempt on Unitronics Unistream"; flow:to_server,established; content:"../"; http_uri; nocase; content:"/etc/passwd"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Unilogic firmware to version 1.35.227 or later. Contact Unitronics support for patch availability.
2. Network Segmentation: Isolate Unitronics devices on a separate VLAN with strict firewall rules. Do not expose them directly to the internet.
3. Access Control: Implement strong authentication and disable default accounts. Use VPNs for remote access.
4. Monitoring: Deploy the detection rules above to monitor for exploitation attempts.
5. Backup: Regularly backup device configurations and firmware to enable recovery.
6. Vendor Communication: Monitor Unitronics security advisories for updates.

Valters IT