CVE-2024-42499

Executive Summary

CVE-2024-42499 is a Path Traversal vulnerability in FitNesse, a web-based wiki and testing framework. The flaw allows an unauthenticated attacker to determine the existence of files at arbitrary paths on the server and, under specific conditions, read partial file contents. The vulnerability affects all FitNesse releases prior to version 20241026. The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation activity in the wild. No public proof-of-concept (PoC) code or exploit templates are currently available.

Supply Chain & Package Security

FitNesse is a Java-based application distributed as a standalone JAR file. It is not typically distributed via package managers like NPM, PyPI, Go, or Ruby. Therefore, supply chain risks are limited to direct download from the official website or Maven Central. Users should verify the integrity of downloaded JAR files using checksums provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file existence and partial content disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to information disclosure. The low EPSS score suggests low active exploitation.

Deep Dive & Mechanics

The vulnerability resides in FitNesse's request handling logic, specifically in the way it processes file paths. FitNesse serves wiki pages and static files from a defined root directory. Due to improper input validation, an attacker can inject path traversal sequences (e.g., ../) into the URL to escape the intended directory.

Root Cause: The application fails to properly sanitize user-supplied path components, allowing traversal outside the web root.

Exploitation Mechanics:

1. An attacker sends a crafted HTTP GET request to the FitNesse server.
2. The request includes path traversal sequences (e.g., ../../etc/passwd).
3. The server resolves the path relative to the web root, but due to insufficient validation, it follows the traversal.
4. The server returns a response indicating whether the file exists (e.g., HTTP 200 vs. 404) and, under specific conditions (e.g., if the file is readable and not binary), may return partial content.

Conditions for Partial Content Disclosure:

• The file must be readable by the FitNesse process.
• The file must be of a type that FitNesse attempts to serve (e.g., text files, wiki pages).
• The server must be configured to allow directory listing or file serving.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-20241026):

// Vulnerable: No path traversal check
public String getFilePath(String requestPath) {
    return rootDirectory + "/" + requestPath;
}

Patched Code (20241026):

// Patched: Normalize and validate path
public String getFilePath(String requestPath) {
    Path normalizedPath = Paths.get(rootDirectory, requestPath).normalize();
    if (!normalizedPath.startsWith(rootDirectory)) {
        throw new SecurityException("Path traversal detected");
    }
    return normalizedPath.toString();
}

The patched version uses Path.normalize() to resolve .. sequences and then verifies that the resulting path still starts with the intended root directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• FitNesse server (version < 20241026) running on a target.
• Network access to the server.

Exploitation Steps:

1. Identify the FitNesse server (e.g., default port 8080).
2. Send a request to check file existence:

   GET /FitNesse/../../etc/passwd HTTP/1.1
   Host: target:8080
   

3. If the file exists, the server may return a 200 OK with partial content (e.g., first few lines). If not, a 404 is returned.

Example using curl:

curl -v "http://target:8080/FitNesse/../../etc/passwd"

Expected Output:

• If file exists: HTTP 200 with content (e.g., root:x:0:0:root:/root:/bin/bash).
• If file does not exist: HTTP 404.

Blue Team

Detection:

• Monitor web server logs for requests containing ../ or ..%2f patterns.
• Look for requests to paths that escape the expected wiki root (e.g., /FitNesse/../../).

Hunting:

• Search for HTTP requests with path traversal sequences in the URI.
• Correlate with file existence checks (e.g., repeated 404/200 patterns for system files).

Lab Setup:

1. Download a vulnerable FitNesse version (e.g., 20241025) from the official archive.
2. Run the server: java -jar fitnesse-standalone.jar -p 8080
3. Test exploitation as described above.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..%2f in the URI path.
  • Requests to paths like /FitNesse/../../etc/passwd or similar.
  • Unusual 200 responses for non-wiki paths.

• File System IOCs:

  • Access logs showing traversal attempts.
  • Unexpected file reads by the FitNesse process (monitor via auditd).

• Log Patterns:

  GET /FitNesse/../../etc/passwd HTTP/1.1
  GET /FitNesse/..%2f..%2fetc%2fpasswd HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2024_42499_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against FitNesse CVE-2024-42499"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42499"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "..%2f"
        $traversal4 = "..%5c"
        $fitnesse = "FitNesse"
    condition:
        any of ($traversal*) and $fitnesse
}

Sigma Rule

title: CVE-2024-42499 FitNesse Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with path traversal sequences targeting FitNesse
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '..\\'
            - '..%5c'
        cs-uri-stem|contains: 'FitNesse'
    condition: selection
falsepositives:
    - Legitimate use of '..' in wiki page names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42499 FitNesse Path Traversal Attempt"; flow:to_server,established; content:"FitNesse"; http_uri; content:"../"; http_uri; distance:0; content:"..%2f"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FitNesse to version 20241026 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict file system permissions for the FitNesse process to limit read access.

Long-term Measures:

• Conduct a code review of custom FitNesse plugins for similar vulnerabilities.
• Implement input validation and canonicalization for all file paths.
• Enable logging and monitoring for path traversal attempts.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "@contains ../" "id:1001,phase:1,deny,status:403,msg:'Path Traversal Attempt'"

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.