CVE-2024-28442

Executive Summary

CVE-2024-28442 identifies a Directory Traversal vulnerability in the Yealink VP59 video phone, specifically in firmware version 91.15.0.118. The flaw resides in the "terms of use" function within the company portal component, allowing a physically proximate attacker to read arbitrary files from the device's filesystem. This can lead to the disclosure of sensitive configuration data, credentials, or other proprietary information. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the EPSS score of 0.0% suggests low exploitation probability in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a hardware device (Yealink VP59) and its embedded firmware. Supply chain risks include the potential for malicious firmware modifications or tampered devices during distribution.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Physical (P) – requires physical proximity.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – affects only the device.
• Confidentiality (C): High (H) – sensitive files can be read.
• Integrity (I): None (N) – no modification possible.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 4.6 (Medium)

Threat Level: Medium. Physical access requirement reduces risk, but the potential for credential theft or configuration leakage is significant.

Deep Dive & Mechanics

The vulnerability is a classic directory traversal (path traversal) flaw in the "terms of use" function of the Yealink VP59 company portal. The company portal is a web-based interface used for device management and configuration. The "terms of use" feature likely loads a file (e.g., a text or HTML file) to display to the user. If the application does not properly sanitize user-supplied input for file paths, an attacker can inject ../ sequences to navigate outside the intended directory and read arbitrary files.

Attack Scenario:

1. An attacker with physical access to the VP59 device (e.g., in a conference room) connects to the company portal via the device's web interface.
2. The attacker manipulates the file path parameter in the "terms of use" request to include directory traversal sequences, such as ../../etc/passwd.
3. The server responds with the contents of the requested file, exposing sensitive data.

Potential Impact:

• Disclosure of device configuration files (e.g., SIP credentials, network settings).
• Reading of system files (e.g., /etc/shadow, /etc/passwd).
• Leakage of corporate network information.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def load_terms_of_use(file_name):
    path = "/var/www/terms/" + file_name
    with open(path, 'r') as f:
        return f.read()

A patched version would sanitize the input:

# Patched pseudo-code
import os

def load_terms_of_use(file_name):
    safe_name = os.path.basename(file_name)
    path = "/var/www/terms/" + safe_name
    if not os.path.exists(path):
        return "File not found"
    with open(path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a Yealink VP59 running firmware 91.15.0.118.
• Network access to the device's web interface (default IP or via direct connection).

Exploitation Steps:

1. Identify the device's IP address (e.g., via DHCP or direct connection).
2. Access the company portal: http://<device-ip>/companyportal
3. Locate the "terms of use" endpoint (e.g., /terms?file=terms.txt).
4. Craft a directory traversal payload:

   GET /terms?file=../../etc/passwd HTTP/1.1
   Host: <device-ip>
   

5. Observe the response containing the contents of /etc/passwd.

Example Request:

GET /companyportal/terms?file=../../../etc/shadow HTTP/1.1
Host: 192.168.1.100
User-Agent: Mozilla/5.0

Blue Team

Detection:

• Monitor web server logs for unusual file path patterns (e.g., ../, %2e%2e%2f).
• Alert on requests to /companyportal/terms with parameters containing directory traversal sequences.
• Use network segmentation to limit physical access to devices.

Hunting:

• Search for logs containing terms?file= followed by ../ or encoded variants.
• Check for outbound connections from the device to unknown IPs (data exfiltration).

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /var/www/terms/
• URL Patterns: /companyportal/terms?file=../
• Log Entries: Requests with ../ in the file parameter.
• Network Traffic: HTTP GET requests to the device's web interface with suspicious query strings.

Detection Engineering

YARA Rule

rule CVE_2024_28442_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against Yealink VP59 terms of use endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28442"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/companyportal/terms"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: Yealink VP59 Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects directory traversal attempts against the Yealink VP59 terms of use endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28442
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains:
            - '/companyportal/terms?file='
            - '../'
            - '..\\'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate file paths containing '..' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28442 Yealink VP59 Directory Traversal Attempt"; flow:to_server; content:"/companyportal/terms"; http_uri; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Physical Access: Ensure Yealink VP59 devices are in secure, access-controlled areas.
2. Network Segmentation: Place devices on a separate VLAN with strict firewall rules.
3. Disable Unnecessary Services: If the company portal is not required, disable it via device settings.

Long-Term Fix:

• Vendor Patch: Contact Yealink for a firmware update. Monitor their security advisory page.
• Input Validation: Implement strict input sanitization for all file path parameters.
• Web Application Firewall (WAF): Deploy a WAF to block directory traversal patterns.

Workaround:

• Modify the device's web server configuration to restrict file access to a specific directory (e.g., using Alias or DocumentRoot).

Valters IT