CVE-2024-31457

Executive Summary

CVE-2024-31457 is a critical code injection vulnerability in the gin-vue-admin backstage management system, specifically in the Plugin System -> Plugin Template feature. An authenticated attacker can exploit a directory traversal flaw in the plugName parameter to create arbitrary folders and inject malicious Go code into the backend. This allows for full remote code execution (RCE) on the server. The vulnerability exists in versions prior to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b (pseudoversion 0.0.0-20240409100909-b1b7427c6ea6). The CVSS score is 7.7 (High), and a public PoC exists. The patch adds input validation to prevent directory traversal.

Supply Chain & Package Security

This vulnerability affects the Go-based gin-vue-admin project. The project is distributed via GitHub and Go modules. The vulnerable code is in the backend plugin template generation logic. The supply chain risk is moderate, as the vulnerability requires authentication and is not in a core dependency but in a feature that generates code. Users should update to the patched version or apply the workaround.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Attacker needs a valid user account.
• User Interaction (UI): None (N) - No user interaction required.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full system compromise possible.
• Integrity (I): High (H) - Arbitrary code can be injected.
• Availability (A): High (H) - Code injection can lead to denial of service.

Threat Level: High. The vulnerability allows for arbitrary code execution with low privileges and no user interaction.

Deep Dive & Mechanics

The vulnerability resides in the plugin template generation feature of gin-vue-admin. The application allows authenticated users to create new plugins by specifying a plugName parameter. This parameter is used to create a directory structure for the plugin, including folders like api, config, global, model, router, service, and a main.go file.

The flaw is that the plugName parameter is not sanitized for path traversal sequences (e.g., ../). An attacker can manipulate this parameter to write files outside the intended plugin directory. For example, by setting plugName to ../../evil, the attacker can create directories and files in arbitrary locations on the filesystem.

Furthermore, the content of the generated Go files is partially controlled by the attacker via a specific PoC parameter. This allows the attacker to inject arbitrary Go code into the generated files. When the application is restarted or the plugin is loaded, this code is executed, leading to remote code execution.

The root cause is the lack of input validation on the PlugName field in the struct used for plugin creation.

Vulnerable vs. Patched Code

Vulnerable Code (pseudoversion 0.0.0-20240407133540-7bc7c3051067):

The vulnerable code likely uses the plugName directly in file path operations without sanitization. A simplified example:

func CreatePlugin(plugName string) {
    basePath := "./plugins/"
    pluginPath := filepath.Join(basePath, plugName)
    os.MkdirAll(pluginPath, 0755)
    // ... create files in pluginPath
}

Patched Code (commit b1b7427c6ea6c7a027fa188c6be557f3795e732b):

The patch adds input validation to prevent directory traversal. A simplified example:

func CreatePlugin(plugName string) {
    // Sanitize plugName to prevent directory traversal
    if strings.Contains(plugName, "..") || strings.Contains(plugName, "/") || strings.Contains(plugName, "\\") {
        // Return error
        return
    }
    basePath := "./plugins/"
    pluginPath := filepath.Join(basePath, plugName)
    os.MkdirAll(pluginPath, 0755)
    // ... create files in pluginPath
}

The patch ensures that the plugName does not contain path traversal characters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the gin-vue-admin instance.
• Access to the Plugin System -> Plugin Template feature.

Exploitation Steps:

1. Authenticate to the gin-vue-admin web interface.
2. Navigate to the Plugin System -> Plugin Template feature.
3. Craft a malicious request to create a plugin with a directory traversal payload in the plugName parameter. For example:
   • plugName: ../../evil
   • pluginContent: (PoC code to inject arbitrary Go code)
4. Send the request (e.g., via Burp Suite or curl).
5. Verify that the directories and files are created in the target location (e.g., /var/www/html/evil/).
6. Trigger execution of the injected code by accessing the generated file or restarting the application.

Example curl command:

curl -X POST \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"plugName":"../../evil","pluginContent":"package main\nimport \"os/exec\"\nfunc init() { exec.Command(\"bash\", \"-c\", \"id > /tmp/pwned\").Run() }"}' \
  https://target.com/api/plugin/create

Blue Team

Detection:

• Monitor for unusual directory creation patterns, especially outside the expected plugin directory.
• Look for requests to the plugin creation endpoint with plugName containing ../ or other path traversal sequences.
• Check for unexpected Go files being created in web-accessible directories.

Hunting:

• Search logs for plugName values containing .. or /.
• Look for processes spawned by the gin-vue-admin application that are not typical.
• Use file integrity monitoring (FIM) to detect unauthorized file creation.

Mitigation:

• Apply the patch immediately.
• If patching is not possible, implement the workaround: manually filter the plugName parameter to reject any input containing .. or /.
• Restrict access to the plugin creation feature to only trusted administrators.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected directories or files created outside the /plugins/ directory.
  • Files with .go extension in web-accessible directories (e.g., /var/www/html/).
  • Presence of files like main.go in unusual locations.
• Network:
  • HTTP requests to /api/plugin/create with plugName containing ../.
• Process:
  • Unusual Go processes or shell commands spawned by the gin-vue-admin process.
• Logs:
  • Error logs indicating failed path traversal attempts.
  • Access logs showing requests to the plugin creation endpoint with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2024_31457_GinVueAdmin_CodeInjection {
    meta:
        description = "Detects directory traversal and code injection attempts in gin-vue-admin plugin creation"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-31457"
        severity = "high"
    strings:
        $traversal = /plugName[^&]*\.\.\// nocase
        $go_code = /package main[\s\S]*?import[\s\S]*?func/
    condition:
        $traversal or $go_code
}

Sigma Rule

title: CVE-2024-31457 - Gin-Vue-Admin Plugin Directory Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects directory traversal attempts in gin-vue-admin plugin creation
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/plugin/create'
        cs-uri-query|contains: 'plugName='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in plugin names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31457 - Gin-Vue-Admin Plugin Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/api/plugin/create"; http_uri; content:"plugName="; http_uri; content:".."; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch: Update to the latest commit (b1b7427c6ea6c7a027fa188c6be557f3795e732b) or a later version.
2. Workaround: If patching is not possible, manually filter the plugName parameter to reject any input containing .. or /. The GitHub Security Advisory provides a filtering method.
3. Restrict access: Limit the plugin creation feature to only trusted administrators.

Long-term Measures:

• Implement input validation for all user-controlled parameters.
• Use a whitelist approach for directory and file names.
• Regularly update dependencies and apply security patches.
• Conduct code reviews focusing on file path operations.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.