CVE-2024-33858

Executive Summary

CVE-2024-33858 is a path injection vulnerability discovered in Logpoint, a Security Information and Event Management (SIEM) solution. The flaw resides in the CSV enrichment source addition functionality. An authenticated attacker can manipulate the source_name parameter to specify an absolute path, causing the CSV file to be written to an arbitrary location within the /tmp directory. This can lead to unauthorized file writes, potentially enabling privilege escalation or persistent access. The vulnerability affects Logpoint versions prior to 7.4.0. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and requires low complexity.

CVSS Breakdown & Threat Level

The CVSS score is currently unassigned (0.0). However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs valid credentials to access the enrichment feature.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): High (H) – Arbitrary file write can corrupt system files or inject malicious content.
• Availability (A): Low (L) – Could lead to denial of service if critical files are overwritten.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Estimated Base Score: 7.1 (High)

Threat Level: High – The vulnerability allows authenticated file writes to /tmp, which can be leveraged for privilege escalation or persistence.

Deep Dive & Mechanics

The vulnerability is a classic path injection (CWE-22) in Logpoint's CSV enrichment source configuration. When an administrator adds a CSV enrichment source, the application accepts a source_name parameter. This parameter is intended to be a filename, but it is not properly sanitized. An attacker can supply an absolute path (e.g., /tmp/evil.csv) instead of a relative filename. The application then writes the CSV file to that absolute path within the /tmp directory.

Root Cause: Insufficient input validation on the source_name parameter. The application does not check for path traversal sequences or absolute paths before writing the file.

Attack Flow:

1. Attacker authenticates to Logpoint with valid credentials.
2. Attacker navigates to the CSV enrichment source configuration.
3. Attacker sets the source_name parameter to an absolute path like /tmp/evil.csv.
4. The application writes the CSV content to /tmp/evil.csv.
5. The attacker can then use this file for further exploitation (e.g., writing a cron job or a script).

Impact: Arbitrary file write to /tmp can be used to:

• Write a cron job that executes a reverse shell.
• Overwrite temporary files used by other processes.
• Plant a malicious script that is executed by a privileged process.

Vulnerable vs. Patched Code

Vulnerable Code (Logpoint < 7.4.0):

def add_csv_enrichment_source(source_name, csv_content):
    # No validation of source_name
    file_path = os.path.join("/tmp", source_name)
    with open(file_path, "w") as f:
        f.write(csv_content)

Patched Code (Logpoint >= 7.4.0):

import os
import re

def add_csv_enrichment_source(source_name, csv_content):
    # Validate source_name to prevent path injection
    if not re.match(r'^[a-zA-Z0-9_\-]+\.csv$', source_name):
        raise ValueError("Invalid source name")
    file_path = os.path.join("/tmp", source_name)
    with open(file_path, "w") as f:
        f.write(csv_content)

The patch adds a regex validation that only allows alphanumeric characters, underscores, hyphens, and the .csv extension. This prevents absolute paths and path traversal sequences.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid Logpoint credentials (low-privileged user).
• Network access to the Logpoint web interface.

Exploitation Steps:

1. Log in to Logpoint.
2. Navigate to Administration > Enrichment > CSV Sources.
3. Click "Add CSV Source".
4. In the source_name field, enter an absolute path like /tmp/evil.csv.
5. Provide CSV content (e.g., a simple header and data).
6. Submit the form.
7. The file is written to /tmp/evil.csv.

Proof of Concept (Python):

import requests

target = "https://logpoint.example.com"
session = requests.Session()
session.auth = ("attacker", "password")

# Add CSV enrichment source with path injection
payload = {
    "source_name": "/tmp/evil.csv",
    "csv_content": "header1,header2\nvalue1,value2"
}
response = session.post(f"{target}/api/enrichment/csv", data=payload)
if response.status_code == 200:
    print("File written to /tmp/evil.csv")
else:
    print("Exploitation failed")

Post-Exploitation: Write a cron job to /tmp/cronjob and then move it to /etc/cron.d/ if permissions allow, or use the file to trigger a reverse shell.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Logpoint logs for unusual source_name values containing absolute paths or path traversal sequences.
2. Check /tmp directory for unexpected CSV files.
3. Review authentication logs for suspicious activity related to enrichment configuration.

Response:

1. Isolate the affected Logpoint instance.
2. Remove any unauthorized CSV files from /tmp.
3. Reset credentials of the compromised user.
4. Apply the patch by upgrading to Logpoint 7.4.0 or later.

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected CSV files in /tmp (e.g., /tmp/evil.csv).
• Log Entries: Logpoint audit logs showing source_name with absolute paths.
• Network Traffic: POST requests to /api/enrichment/csv with suspicious source_name parameters.
• Process Anomalies: Processes reading or executing files from /tmp that were not expected.

Detection Engineering

YARA Rule

rule CVE_2024_33858_Logpoint_Path_Injection {
    meta:
        description = "Detects path injection attempts in Logpoint CSV enrichment source_name"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33858"
    strings:
        $path_injection = /source_name[^&]*\/[a-zA-Z0-9_\-]+\.csv/ nocase
        $absolute_path = /source_name[^&]*\/tmp\// nocase
    condition:
        any of them
}

Sigma Rule

title: Logpoint CSV Enrichment Path Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path injection attempts in Logpoint CSV enrichment source_name parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33858
logsource:
    category: web
    product: logpoint
detection:
    selection:
        cs-uri-query|contains: 
            - "source_name=/"
            - "source_name=.."
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33858 Logpoint CSV Enrichment Path Injection"; flow:to_server,established; content:"POST"; http_method; content:"/api/enrichment/csv"; http_uri; content:"source_name=/"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint to version 7.4.0 or later.
2. If upgrade is not possible, restrict access to the CSV enrichment feature to trusted administrators only.
3. Implement network segmentation to limit exposure of the Logpoint web interface.

Long-Term Fixes:

• Apply input validation on all user-supplied parameters.
• Use allowlists for file paths and names.
• Conduct regular security audits of the application.

Workaround:

• Disable the CSV enrichment feature if not in use.
• Monitor /tmp for unexpected file creations.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.