CVE-2024-33860

Executive Summary

CVE-2024-33860 is a Local File Inclusion (LFI) vulnerability in Logpoint, a Security Information and Event Management (SIEM) platform, affecting versions prior to 7.4.0. The flaw resides in the File System Collector component, which allows an authenticated attacker to specify an arbitrary file path. When the collector processes this path, the content of the targeted file is ingested into the Logpoint system as incoming logs, effectively exposing sensitive data. This vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward for an authenticated user with collector configuration privileges.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs valid credentials with collector configuration rights.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. The vulnerability allows an authenticated attacker to read arbitrary files on the Logpoint server, including configuration files, credentials, and other sensitive data. Given that Logpoint is a SIEM platform, it may contain logs from multiple systems, making this a critical data exfiltration risk.

Deep Dive & Mechanics

The File System Collector in Logpoint is designed to monitor and ingest log files from specified directories. The vulnerability arises because the collector does not properly validate or sanitize the file path provided by the user. An attacker with access to configure the collector can set the path to an arbitrary file, such as /etc/shadow or /var/log/syslog. When the collector runs, it reads the file and sends its contents as log entries to the Logpoint system. This bypasses any intended access controls, as the collector runs with elevated privileges.

The root cause is a lack of path traversal validation. The collector should restrict paths to a predefined directory (e.g., /var/log/) but fails to do so. This is a classic example of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.4.0):

# Example of vulnerable collector configuration
class FileSystemCollector:
    def __init__(self, config):
        self.file_path = config['file_path']  # No validation

    def collect(self):
        with open(self.file_path, 'r') as f:
            for line in f:
                self.send_log(line)

Patched Code (7.4.0+):

# Example of patched collector with path validation
import os

class FileSystemCollector:
    ALLOWED_BASE = '/var/log/'

    def __init__(self, config):
        raw_path = config['file_path']
        # Resolve and validate path
        resolved = os.path.realpath(raw_path)
        if not resolved.startswith(self.ALLOWED_BASE):
            raise ValueError("Path not allowed")
        self.file_path = resolved

    def collect(self):
        with open(self.file_path, 'r') as f:
            for line in f:
                self.send_log(line)

The patch introduces a check using os.path.realpath() to resolve symlinks and relative paths, then verifies that the resolved path starts with the allowed base directory (/var/log/). This prevents access to files outside the intended scope.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid Logpoint credentials with permissions to create or modify a File System Collector.
• Network access to the Logpoint web interface or API.

Exploitation Steps:

1. Log in to the Logpoint web interface.
2. Navigate to Collectors > File System Collector.
3. Create a new collector or edit an existing one.
4. In the File Path field, enter an arbitrary path, e.g., /etc/shadow.
5. Save the configuration and trigger the collector to run.
6. View the incoming logs to see the contents of /etc/shadow.

Example API Request (if applicable):

curl -X POST https://logpoint-server/api/collectors \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"type": "file_system", "file_path": "/etc/shadow", "name": "malicious_collector"}'

Blue Team

Detection:

• Monitor for collectors with file paths outside the expected base directory (e.g., /var/log/).
• Alert on any collector configuration changes, especially those involving unusual paths.
• Review logs for sudden ingestion of sensitive file contents (e.g., password hashes, private keys).

Hunting:

• Query Logpoint logs for events where the source is a File System Collector and the log content contains patterns like root:*: (shadow file) or BEGIN RSA PRIVATE KEY.
• Use the following Sigma rule to detect suspicious collector paths.

Indicators of Compromise (IOCs)

• File Paths: /etc/shadow, /etc/passwd, /etc/ssh/sshd_config, /root/.ssh/id_rsa, /var/log/auth.log
• Log Content Patterns: root:*:, BEGIN RSA PRIVATE KEY, ssh-rsa AAAAB3NzaC1yc2E...
• Collector Names: Any collector with a name suggesting malicious intent (e.g., "shadow_collector")
• API Calls: POST requests to /api/collectors with unusual file_path values

Detection Engineering

YARA Rule

rule CVE_2024_33860_LFI_Logpoint {
    meta:
        description = "Detects Logpoint File System Collector LFI exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-33860"
    strings:
        $shadow = "root:*:" ascii
        $private_key = "BEGIN RSA PRIVATE KEY" ascii
        $ssh_key = "ssh-rsa AAAA" ascii
        $config = "PermitRootLogin" ascii
    condition:
        any of them
}

Sigma Rule

title: Logpoint File System Collector LFI
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious file paths in Logpoint File System Collector configurations
author: Valters IT
logsource:
    product: logpoint
    service: collector
detection:
    selection:
        collector_type: "file_system"
        file_path|contains:
            - "/etc/"
            - "/root/"
            - "/var/log/auth.log"
    condition: selection
falsepositives:
    - Legitimate monitoring of system files (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-33860 Logpoint File System Collector LFI";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/collectors"; http_uri;
    content:"file_path"; nocase;
    pcre:"/file_path[\"']?\s*[:=]\s*[\"']?\/etc\//";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint to version 7.4.0 or later.
2. If upgrade is not possible, restrict access to the File System Collector configuration to only trusted administrators.
3. Implement network segmentation to limit access to the Logpoint web interface.

Long-Term Measures:

• Apply the principle of least privilege for collector configurations.
• Regularly audit collector paths and configurations.
• Enable logging and alerting for collector changes.
• Conduct periodic vulnerability scans.

Workarounds:

• Use a web application firewall (WAF) to block requests with suspicious file paths in the collector API.
• Manually validate file paths in the collector configuration if custom scripts are used.

Valters IT