CVE-2024-3737

Executive Summary

CVE-2024-3737 is a critical path traversal vulnerability discovered in cym1102 nginxWebUI, a web-based interface for managing Nginx configurations. The flaw resides in the /adminPage/www/addOver endpoint, specifically within the findCountByQuery function. By manipulating the dir parameter, an unauthenticated remote attacker can traverse directories outside the intended web root, potentially reading arbitrary files on the server. The vulnerability has a CVSS score of 6.3 (Medium), but due to the lack of authentication requirements and public exploit disclosure, it poses a significant risk to unpatched instances. No official patch has been released as of the latest advisory.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a standalone Java-based application (nginxWebUI) distributed via GitHub releases. Users should verify the integrity of their downloaded binaries and monitor the official repository for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file read
• Integrity Impact: Low (I:L) – potential file overwrite if combined with other flaws
• Availability Impact: Low (A:L) – potential denial of service via resource exhaustion

Threat Level: High due to public exploit availability and no authentication required.

Deep Dive & Mechanics

The vulnerability exists in the findCountByQuery function within /adminPage/www/addOver. This function is designed to count files matching a query in a specified directory. The dir parameter is passed directly to file system operations without proper sanitization or validation. An attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and access arbitrary files on the filesystem.

Root Cause: The application fails to validate or sanitize the dir parameter, allowing directory traversal. The function likely uses Java's File class or similar, which resolves ../ sequences.

Attack Vector: Remote, unauthenticated HTTP requests to the vulnerable endpoint.

Impact: An attacker can read sensitive files such as /etc/passwd, application configuration files, or Nginx configuration files. In some scenarios, if the application also allows writing, this could lead to remote code execution.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the findCountByQuery method. A patched version would include input validation.

Vulnerable Code (Conceptual):

public int findCountByQuery(String dir, String query) {
    File directory = new File(dir);
    // No validation of dir parameter
    File[] files = directory.listFiles();
    // ... count files matching query
}

Patched Code (Conceptual):

public int findCountByQuery(String dir, String query) {
    // Validate and sanitize the dir parameter
    if (dir == null || dir.contains("..") || dir.contains("/") || dir.contains("\\")) {
        throw new SecurityException("Invalid directory path");
    }
    // Ensure dir is within allowed base path
    File baseDir = new File("/allowed/base/path");
    File directory = new File(baseDir, dir);
    if (!directory.getCanonicalPath().startsWith(baseDir.getCanonicalPath())) {
        throw new SecurityException("Path traversal detected");
    }
    File[] files = directory.listFiles();
    // ... count files matching query
}

Exploitation & Lab Setup

Red Team (Offensive)

Exploit Proof of Concept (PoC): The following curl command demonstrates the path traversal:

curl -X POST "http://target:8080/adminPage/www/addOver" \
  -d "dir=../../../../etc/passwd&query=root"

Expected Response: The server returns a count of lines matching "root" in /etc/passwd, confirming file read.

Lab Setup:

1. Deploy nginxWebUI v3.9.9 in a Docker container:

   docker run -d -p 8080:8080 --name nginxwebui cym1102/nginxwebui:3.9.9
   

2. Access the web interface at http://localhost:8080.
3. Execute the PoC above.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /adminPage/www/addOver with suspicious dir parameters containing ../ or absolute paths.
• Use the detection rules provided below.

Mitigation:

• Immediately restrict access to the /adminPage endpoint using a reverse proxy or firewall rules.
• Apply input validation on the dir parameter if source code access is available.
• Monitor for official patches from the vendor.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /adminPage/www/addOver with dir parameter containing ../ or /etc/.
  • Unusual file read patterns from the server.
• File System:
  • Access to /etc/passwd, /etc/shadow, or application configuration files outside the web root.
• Logs:
  • Application logs showing findCountByQuery calls with suspicious dir values.

Detection Engineering

YARA Rule

rule CVE_2024_3737_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in nginxWebUI CVE-2024-3737"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3737"
    strings:
        $traversal = /dir=\.\.(\/|\\)/
        $endpoint = "/adminPage/www/addOver"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2024-3737 Path Traversal in nginxWebUI
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts targeting nginxWebUI CVE-2024-3737
author: Valters IT
date: 2024/05/20
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/adminPage/www/addOver'
        cs-uri-query|contains: 'dir='
    condition: selection
falsepositives:
    - Legitimate use of the feature with valid directories
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3737 Path Traversal in nginxWebUI"; flow:to_server,established; content:"POST"; http_method; content:"/adminPage/www/addOver"; http_uri; content:"dir="; http_client_body; pcre:"/dir=[^&]*\.\.\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Block access to /adminPage endpoint via firewall or reverse proxy (e.g., Nginx location /adminPage { deny all; }).
   • Monitor logs for exploitation attempts.
2. Long-term Fix:
   • Apply input validation and sanitization to the dir parameter.
   • Use a whitelist of allowed directories.
   • Upgrade to a patched version once released.
3. Workaround:
   • If source code is available, modify the findCountByQuery function to reject paths containing .. or absolute paths.

Valters IT